Use-After-Free in FreeRDP Client RDPGFX Channel

Executive Summary

This is a use-after-free vulnerability in FreeRDP versions before 3.32.2. A malicious RDP server can exploit it by opening and closing a duplicate-named channel with a new ChannelId, which overwrites the listener's callback slot. When the slot is freed without clearing, the server can send a PDU on the original channel, causing a crash or potential code execution.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the FreeRDP version in use. Run 'xfreerdp --version' or 'freerdp2 --version' on Linux systems to verify if the installed version is below 3.32.2. Monitor network traffic for suspicious RDP server behavior, particularly duplicate channel names in Dynamic Virtual Channel data.

Useful 0 Not Useful 0

Impact Analysis

If you use FreeRDP versions before 3.32.2, a malicious RDP server could crash your client or execute arbitrary code on your system. This could lead to data loss, unauthorized access, or system compromise without requiring user interaction.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FreeRDP to version 3.32.2 or later. Disable the rdpgfx dynamic virtual channel if not required by adding '/rdpgfx' to the command line arguments. Restrict RDP server access to trusted networks and monitor for unusual channel activity.

Useful 0 Not Useful 0