FreeRDP DRDYNVC解析器释放后使用漏洞(CWE-416)导致服务器DoS分析

漏洞概述 漏洞名称：FreeRDP 服务器 DRDYNVC 解析器在并发通道关闭时发生 use-after-free（释放后使用） 漏洞类型：CWE-416（释放后使用）/ CWE-362（共享资源缺乏同步的并发执行） 触发条件：经过身份验证的恶意客户端发送未知 SDPDU 消息并覆盖 DRDYNVC 数据，导致通道关闭时解析器访问已释放的内存 严重等级：High（CVSS 7.5/10） 影响范围 受影响版本：FreeRDP >= 2.0.0 且 pContext->references == 0) channel_free(channel); } // 修复后：增加引用计数检查，避免在引用计数为 0 时释放 static void rfx_per_channel_release(void ptr) { rfxPerChannel channel = ptr; if (ClientContext->pContext->references == 0) { rfxPerChannel rfx_channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; if (channel != NULL) { rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel* channel = NULL; rfx

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

FreeRDP DRDYNVC解析器释放后使用漏洞(CWE-416)导致服务器DoS分析

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

FreeRDP DRDYNVC解析器释放后使用漏洞(CWE-416)导致服务器DoS分析

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！