Missing Release of Resource after Effective Lifetime in FreeRDP - #VU156168

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service by exhausting the FreeRDP client process's file descriptors.

The vulnerability exists due to missing release of file descriptors in the parallel_process_irp_create function when handling repeated IRP_MJ_CREATE requests after a user connects to a hostile RDP server. A remote attacker can repeatedly send these requests for the announced parallel device, causing each successful open to replace parallel->file without closing the previous descriptor, to exhaust the process descriptor table and prevent further descriptor allocation.

Exploitation requires explicit client-side parallel-device redirection to a local path that can be opened.

Affected software

Remediation

External References

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8g9g-hqqp-fw69

Related Security Bulletins

• Multiple vulnerabilities in FreeRDP