Information Disclosure in FreeRDP via Uninitialized Memory in RDPGFX

Executive Summary

This is an information disclosure vulnerability in FreeRDP versions before 3.31.0. The RDPGFX server's ResetGraphics PDU serializer fails to initialize padding bytes in a 340-byte wire format. Attackers can receive uninitialized heap memory containing live pointers and GLib function addresses, which helps bypass heap ASLR and disclose module base addresses.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking FreeRDP versions on affected systems. Use commands like 'xfreerdp --version' or 'apt list --installed | grep freerdp' to identify versions before 3.31.0. Monitor network traffic for ResetGraphics PDU exchanges if RDPGFX is enabled.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to leak sensitive memory contents, including heap pointers and function addresses. This could enable further attacks like bypassing security mechanisms or gaining unauthorized access to system information. The impact depends on the attacker's ability to trigger ResetGraphics operations over an active RDPGFX channel.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.31.0 or later. If upgrading is not possible, apply the patch from the GitHub Security Advisory (GHSA-r7jx-j9h7-j4xj) or modify the serializer to initialize padding bytes explicitly.

Useful 0 Not Useful 0