Double-Free in FreeRDP via NSCodec Allocation Failure

Executive Summary

FreeRDP before version 3.32.0 has a double-free vulnerability in the NSCodec plane initialization function. When a crafted RDP client negotiates NSCodec with a large desktop geometry, a buffer growth failure occurs. This leaves dangling plane pointers, causing the server to crash during context teardown due to a double-free condition.

Useful 0 Not Useful 0

Detection Guidance

Monitor FreeRDP server logs for crashes or segmentation faults during RDP sessions. Use network traffic analysis tools like Wireshark to detect clients negotiating NSCodec with unusually large desktop geometries. Check for double-free errors in system logs using commands like 'dmesg | grep -i segfault' or 'journalctl -b | grep -i segfault'.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this by sending malicious input to crash the FreeRDP server, causing a denial-of-service (DoS). The server would become unavailable until restarted, disrupting remote desktop services.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later to patch the vulnerability. If upgrading is not immediately possible, restrict access to the FreeRDP server by limiting network exposure or using firewalls to block untrusted RDP clients.

Useful 0 Not Useful 0