NULL Pointer Dereference in FreeRDP ARM Gateway Response

Executive Summary

This vulnerability is a NULL pointer dereference in FreeRDP versions 3.0.0-beta4 through 3.32.0. It occurs in the arm_handle_request_ok function when an ARM endpoint returns an empty HTTP 200 response body. Attackers controlling the ARM gateway can send a zero-length body, causing the client to pass NULL to strnlen and crash the connecting client.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking FreeRDP versions and ARM gateway configurations. Verify FreeRDP version with 'xfreerdp --version' or 'apt list --installed | grep freerdp'. Check ARM gateway settings in FreeRDP configuration files for enabled AAD and ARM transport. Monitor network traffic for HTTP 200 responses with empty bodies from ARM endpoints using tools like Wireshark or tcpdump.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers controlling the ARM gateway to crash FreeRDP client processes during connection attempts. This results in denial of service, preventing users from establishing remote desktop sessions. The attack requires specific conditions: the client must use ARM transport, be built with AAD enabled, and the attacker must control the ARM endpoint or have a trusted interception position.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FreeRDP to version 3.32.0 or later. Disable ARM gateway transport if not required. If ARM is necessary, ensure the gateway endpoint is trusted and properly configured. Add input validation to reject empty HTTP 200 responses from ARM endpoints. Monitor client crashes during connection attempts as potential exploitation signs.

Useful 0 Not Useful 0