Out-of-Bounds Read in FreeRDP Smartcard Response Decoder

Executive Summary

This is an out-of-bounds read vulnerability in FreeRDP versions before 3.31.0. It occurs in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in specific responses, causing the server to read beyond allocated memory, leading to process termination.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking FreeRDP versions and monitoring for suspicious smartcard-related traffic. Use 'xfreerdp --version' or 'freerdp2 --version' to verify if your FreeRDP version is below 3.31.0. Inspect network traffic for oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses using tools like Wireshark with RDP protocol filters.

Useful 0 Not Useful 0

Impact Analysis

An attacker with authenticated access to an RDP session could exploit this to crash the FreeRDP server process, causing denial of service. If smartcard redirection is enabled, this could disrupt services relying on remote smartcard access, potentially affecting operations in network-facing environments.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.31.0 or later. Disable smartcard redirection in RDP configurations if not required. Monitor RDP server logs for process crashes or unusual activity related to smartcard handling. Apply network-level mitigations like restricting RDP access to trusted sources.

Useful 0 Not Useful 0