CVE-2024-32458
📋 TL;DR
FreeRDP clients prior to versions 3.5.0 or 2.11.6 contain an out-of-bounds read vulnerability (CWE-125) that could allow remote attackers to read sensitive memory contents or cause denial of service. This affects all FreeRDP-based remote desktop clients using vulnerable versions. The vulnerability has a CVSS score of 9.8, indicating critical severity.
💻 Affected Systems
- FreeRDP
- All software using FreeRDP library
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Freerdp by Freerdp
Freerdp by Freerdp
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or persistent backdoor installation.
Likely Case
Denial of service (client crash) or information disclosure through memory content leakage.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized connections.
🎯 Exploit Status
Exploitation requires client to connect to malicious server. No authentication needed on client side.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.0 or 2.11.6
Vendor Advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vvr6-h646-mp4p
Restart Required: Yes
Instructions:
1. Update FreeRDP to version 3.5.0 or 2.11.6. 2. For Linux: Use package manager (apt/yum/dnf). 3. For Windows: Download from official releases. 4. Restart affected applications/services.
🔧 Temporary Workarounds
Use GFX or RFX modes
allForce use of graphics modes that are not vulnerable (on by default but require server support)
xfreerdp /gfx /v:server
xfreerdp /rfx /v:server
🧯 If You Can't Patch
- Restrict RDP connections to trusted servers only using firewall rules
- Implement network segmentation to isolate FreeRDP clients from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check FreeRDP version: xfreerdp --version or freerdp --versionCheck Version:
xfreerdp --version 2>&1 | head -1Verify Fix Applied:
Confirm version is 3.5.0 or higher (3.x branch) or 2.11.6 or higher (2.x branch)📡 Detection & Monitoring
Log Indicators:
- Unexpected client crashes
- Memory access violation errors in application logs
Network Indicators:
- RDP connections to unknown/untrusted servers
- Abnormal RDP traffic patterns
SIEM Query:
source="*freerdp*" AND (event="crash" OR event="segmentation fault" OR event="access violation")🔗 References
- https://github.com/FreeRDP/FreeRDP/pull/10077
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vvr6-h646-mp4p
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/
- https://github.com/FreeRDP/FreeRDP/pull/10077
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vvr6-h646-mp4p
- https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/
