Heap Buffer Overflow in FreeRDP Persistent Cache

Executive Summary

This is a heap buffer overflow in FreeRDP before version 3.32.0. It occurs in the persistent_cache_read_entry_v2 function when processing a malicious persistent cache v2 file. Attackers exploit integer wraparound during bitmap size calculation by setting large width and height values, causing incorrect buffer accounting. This leads to heap memory corruption, crashes, or code execution when the file is loaded.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the FreeRDP version installed on your system. Run: freerdp2-shadow --version or apt list --installed | grep freerdp. If the version is 3.31.1 or earlier, the system is vulnerable. Inspect persistent cache v2 files for malformed width and height values in bitmap entries.

Useful 0 Not Useful 0

Impact Analysis

If you use FreeRDP versions before 3.32.0, an attacker could craft a malicious cache file that triggers heap corruption when loaded. This may cause the FreeRDP client to crash or allow arbitrary code execution within the client process. Exploitation requires local user interaction, such as loading the malicious file.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized code execution or data corruption in systems using FreeRDP. If exploited, it may lead to unauthorized access to sensitive data processed by the FreeRDP client, violating confidentiality requirements under these regulations. The risk is heightened if the FreeRDP client handles protected health information or personal data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later immediately. Avoid loading untrusted persistent cache v2 files. If upgrading is not possible, disable persistent caching in FreeRDP configurations to prevent exploitation.

Useful 0 Not Useful 0