Remote DoS in GNOME Remote Desktop via RDP Connection Exhaustion

Executive Summary

This is a denial-of-service vulnerability in gnome-remote-desktop's RDP connection handling. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. This exhausts the global connection limit, blocking new RDP clients from connecting until holding sockets are closed.

Useful 0 Not Useful 0

Detection Guidance

Monitor for excessive RDP connection attempts or open sockets without completing handshakes. Check gnome-remote-desktop logs for repeated failed authentication attempts or connection timeouts. Use netstat or ss to inspect active RDP connections and identify suspicious IPs holding slots indefinitely.

Useful 0 Not Useful 0

Impact Analysis

An attacker could prevent legitimate users from establishing new RDP connections to the affected system by exhausting available connection slots. This disrupts remote desktop access but does not compromise confidentiality, integrity, or allow code execution. Authenticated sessions already in progress remain unaffected.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the RDP listener in gnome-remote-desktop if not needed. Restrict access to the RDP port (default 3389) via firewall rules to trusted IPs only. Monitor connection limits and close suspicious sockets manually if the global limit is exceeded.

Useful 0 Not Useful 0