RemoteFX Denial of Service in FreeRDP

Executive Summary

This is a denial of service vulnerability in FreeRDP versions 3.0.0 through 3.32.1. A malicious RDP server can send a crafted RemoteFX region rectangle with an x-coordinate set to 65535 and a destination surface left position less than 1. This triggers a 16-bit coordinate assertion in the client's rfx_process_message function, causing the client process to terminate abruptly.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your FreeRDP client is built with verbose WinPR assertions enabled. Inspect the client version and build configuration. Monitor for client crashes when connecting to RDP servers, particularly those negotiating RemoteFX graphics. No specific commands are provided in the resources, but logging and monitoring client termination events may help identify exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

If you use a vulnerable FreeRDP client built with verbose WinPR assertions enabled, an attacker could trick you into connecting to a malicious RDP server. This would cause your client to crash, resulting in loss of availability for your session. It does not lead to data disclosure, modification, or memory corruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability, causing service disruptions. It does not directly affect data confidentiality or integrity. Compliance impact would depend on whether service unavailability violates specific availability requirements in standards like GDPR or HIPAA, but no direct data exposure occurs.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.2 or later to address the vulnerability. Disable RemoteFX graphics in client configurations if possible. Avoid connecting to untrusted RDP servers. Monitor for updates from FreeRDP and apply patches promptly. The vulnerability requires client-side fixes as server-side exploitation depends on client behavior.

Useful 0 Not Useful 0