Infinite Loop in FreeRDP WebSocket Handling

Executive Summary

FreeRDP before version 3.32.2 has an infinite loop vulnerability in the websocket_context_read function. A malicious RD Gateway can send a truncated WebSocket frame followed by a TLS close_notify alert. This causes a client thread to spin indefinitely, consuming CPU resources until the process is killed. The issue occurs because the function fails to handle a zero BIO result when payload data remains outstanding.

Useful 0 Not Useful 0

Detection Guidance

Monitor CPU usage spikes on systems running FreeRDP clients. Check for network traffic patterns involving RD Gateway connections with truncated WebSocket frames. Use tools like Wireshark to inspect WebSocket frames for incomplete payloads followed by TLS close_notify alerts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service by consuming excessive CPU resources on the affected system. It may lead to system slowdowns, unresponsiveness, or crashes due to the infinite loop. Users may experience degraded performance or complete loss of service when connecting through a vulnerable FreeRDP client.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.2 or later. Disable RD Gateway WebSocket connections if not required. Apply network-level controls to block malformed WebSocket frames. Monitor for unusual CPU usage on FreeRDP client processes.

Useful 0 Not Useful 0