NULL Stream Dereference in FreeRDP Client via Malicious RD Gateway

Executive Summary

This vulnerability is a NULL pointer dereference flaw in FreeRDP clients (versions 2.3.0 to 3.31.1). A malicious or compromised RD Gateway can send a malformed CLOSE_CHANNEL packet with only an eight-byte header and no payload. This causes the client to crash when processing the packet in the rdg_process_close_packet function.

Useful 0 Not Useful 0

Detection Guidance

Monitor FreeRDP client logs for crashes or connection drops when connecting through an RD Gateway. Check for malformed CLOSE_CHANNEL packets in network traffic using tools like Wireshark with filters for FreeRDP protocol packets. Inspect system logs for segmentation faults or null pointer dereference errors in FreeRDP processes.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker controlling the RD Gateway to crash FreeRDP clients, disrupting their availability. It does not affect confidentiality or integrity of data. The attack requires network access and control of the RD Gateway or bypassing certificate validation.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid using vulnerable FreeRDP versions (2.3.0 to 3.31.1). If possible, upgrade to FreeRDP 3.32.0 or later once available. Disable RD Gateway connections if not required. Ensure certificate validation is enforced to prevent man-in-the-middle attacks. Monitor for suspicious network traffic targeting FreeRDP ports.

Useful 0 Not Useful 0