FreeRDP DRDYNVC Parser Use-After-Free (CWE-416) Causing Server DoS Analysis

Vulnerability Overview Vulnerability Name: FreeRDP server DRDYNVC parser use-after-free during concurrent channel closure Vulnerability Type: CWE-416 (Use After Free) / CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) Trigger Condition: An authenticated malicious client sends unknown SDPDU messages and overwrites DRDYNVC data, causing the parser to access freed memory during channel closure Severity Level: High (CVSS 7.5/10) Impact Affected Versions: FreeRDP >= 2.0.0 and pContext->references == 0) channel_free(channel); } // After fix: Adds a reference count check to avoid freeing when the reference count is 0 static void rfx_per_channel_release(void ptr) { rfxPerChannel channel = ptr; if (ClientContext->pContext->references == 0) { rfxPerChannel rfx_channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; if (channel != NULL) { rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel channel = NULL; rfxPerChannel* channel = NULL; rfx

Goal Reached Thanks to every supporter — we hit 100%!

FreeRDP DRDYNVC Parser Use-After-Free (CWE-416) Causing Server DoS Analysis

More from this source