Null Pointer Dereference in FreeRDP via NSCodec Surface Bits

Executive Summary

FreeRDP before version 3.31.0 has a null pointer dereference flaw in the gdi_surface_bits function. This occurs when processing Surface Bits commands using the NSCodec codec ID. A malicious RDP server can exploit this by sending a specially crafted command that claims to use NSCodec, even if the codec is disabled, causing the FreeRDP client to crash.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring FreeRDP client crashes when connecting to an RDP server. Check logs for null pointer dereference errors in gdi_surface_bits. Ensure FreeRDP is updated to version 3.31.0 or later to avoid exploitation.

Useful 0 Not Useful 0

Impact Analysis

If you use FreeRDP versions before 3.31.0, a malicious RDP server could crash your FreeRDP client application. This could lead to denial of service, disrupting your remote desktop sessions. However, it does not appear to allow code execution or data theft based on the provided details.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FreeRDP to version 3.31.0 or later. Avoid connecting to untrusted RDP servers. Monitor network traffic for suspicious Surface Bits commands with NSCodec ID. Disable NSCodec if not required.

Useful 0 Not Useful 0