Out-of-Bounds Write in FreeRDP USB Redirection

Executive Summary

This vulnerability is an out-of-bounds write flaw in FreeRDP versions before 3.31.0. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past a 16-byte buffer in the urbdrc client channel's urb_send_current_frame_number_result() function. This causes denial of service when verbose asserts are enabled.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking FreeRDP versions and monitoring for suspicious USB redirection activity. Use 'xfreerdp --version' or 'freerdp2 --version' to verify if your FreeRDP version is below 3.31.0. Inspect RDP server logs for unusual USB redirection messages or crashes during client connections.

Useful 0 Not Useful 0

Impact Analysis

If you use FreeRDP versions 3.14.0 through 3.30.0 with USB redirection enabled, a malicious RDP server could crash your client or corrupt memory. The attack requires a redirected USB device to be present but does not depend on the actual device type.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service or memory corruption in FreeRDP clients when a malicious RDP server sends a crafted message. It does not directly impact data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, if the denial of service disrupts critical systems handling protected health or personal data, it could indirectly affect compliance by impairing access to necessary systems.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.31.0 or later. Disable USB redirection in RDP client configurations if not required. Monitor network traffic for malicious USB redirection attempts and apply patches to all affected systems.

Useful 0 Not Useful 0