Denial of Service in FreeRDP via Zero-Length DATA PDUs

Executive Summary

FreeRDP before version 3.32.2 has a denial of service flaw in its shadow server. Authenticated RDP clients can exploit this by sending zero-length DATA PDUs on specific channels (audin or rdpgfx). This causes the server to spin threads indefinitely without processing the messages, consuming full CPU cores until the client disconnects.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring FreeRDP shadow server logs for excessive CPU usage or repeated zero-length DATA PDUs. Check for clients sending empty messages on audin or rdpgfx channels. Use network monitoring tools like Wireshark to inspect RDP traffic for unusual patterns.

Useful 0 Not Useful 0

Impact Analysis

If you use FreeRDP in a multi-user environment, attackers with valid credentials could exploit this to crash or severely degrade server performance. This may lead to service unavailability for other users and increased operational costs due to resource exhaustion.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.2 or later to patch the vulnerability. If upgrading is not immediately possible, restrict RDP access to trusted networks and monitor shadow server performance closely. Disable unnecessary channels like audin or rdpgfx if they are not required.

Useful 0 Not Useful 0