FreeRDP Memory Exhaustion via Serial Device-Control IRP

Executive Summary

FreeRDP before version 3.32.2 has a flaw where it fails to limit the OutputBufferLength in serial device-control IRP requests. A malicious server with serial redirection enabled can send a crafted request with IOCTL_USBPRINT_GET_1284_ID and a near-maximum length, causing the client to allocate excessive memory. This leads to memory exhaustion and potential denial of service.

Useful 0 Not Useful 0

Detection Guidance

Monitor for abnormal memory usage on FreeRDP clients with serial redirection enabled. Check for processes consuming excessive memory (e.g., >4 GiB) during serial IRP_MJ_DEVICE_CONTROL requests. Use tools like 'top', 'htop', or 'Process Explorer' to track memory allocation spikes. Inspect network traffic for large OutputBufferLength values in IOCTL_USBPRINT_GET_1284_ID requests.

Useful 0 Not Useful 0

Impact Analysis

If you use FreeRDP versions before 3.32.2 with serial redirection enabled and connect to a malicious server, your system may experience memory exhaustion. This can cause the FreeRDP client to crash or become unresponsive, leading to a denial of service. The impact is limited to systems running vulnerable FreeRDP clients.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.2 or later to address the flaw. Disable serial redirection if not required. Implement network-level controls to block untrusted RDP connections with serial device control requests. Monitor for and terminate suspicious sessions exploiting this issue.

Useful 0 Not Useful 0