FreeRDP Server Denial of Service via Truncated Input Event

Executive Summary

This vulnerability affects FreeRDP versions 3.0.0 through 3.32.1. A remote RDP client with an active session can send a truncated input event with an unknown message type, causing the server to skip the event's six-byte body without verifying it fits within the packet's declared length. This triggers a WinPR stream assertion failure, terminating the server process and causing a denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor FreeRDP server processes for unexpected terminations or assertion failures. Check logs for messages like 'unknown message type' followed by fatal assertions. Use network monitoring tools to inspect RDP traffic for truncated slow-path input events with unknown message types.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a remote attacker to terminate FreeRDP server processes, disrupting RDP sessions and services. If the server is built with active WinPR assertions, the attacker can cause a denial of service without needing authentication or accessing sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Disable WinPR assertions in FreeRDP builds by setting WITH_VERBOSE_WINPR_ASSERT=OFF. Ensure Network Level Authentication (NLA) is enabled to prevent unauthenticated clients from reaching the vulnerable parser. Monitor for malformed input events and update FreeRDP once a patched version is released.

Useful 0 Not Useful 0