CVE-2024-32459
📋 TL;DR
FreeRDP clients and servers running versions before 3.5.0 or 2.11.6 contain an out-of-bounds read vulnerability that could allow attackers to read sensitive memory contents. This affects all systems using vulnerable FreeRDP implementations for Remote Desktop Protocol connections. The vulnerability has a critical CVSS score of 9.8 due to its potential for information disclosure or as a stepping stone to more severe attacks.
💻 Affected Systems
- FreeRDP client
- FreeRDP server
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Freerdp by Freerdp
Freerdp by Freerdp
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or lateral movement within networks
Likely Case
Information disclosure, denial of service, or memory corruption leading to application crashes
If Mitigated
Limited impact with proper network segmentation and access controls, potentially just application instability
🎯 Exploit Status
Out-of-bounds read vulnerabilities often require specific conditions to achieve more than information disclosure, but can be chained with other vulnerabilities for greater impact.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.0 or 2.11.6
Vendor Advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cp4q-p737-rmw9
Restart Required: Yes
Instructions:
1. Identify FreeRDP version using 'xfreerdp --version' or equivalent. 2. Update to version 3.5.0 or 2.11.6 using your package manager (apt, yum, brew) or compile from source. 3. Restart all FreeRDP services and applications.
🔧 Temporary Workarounds
No known workarounds
allThe vendor advisory states no workarounds are available
🧯 If You Can't Patch
- Restrict network access to FreeRDP services using firewalls or network segmentation
- Monitor for abnormal FreeRDP process behavior and memory usage patterns
🔍 How to Verify
Check if Vulnerable:
Run 'xfreerdp --version' and check if version is below 3.5.0 (for 3.x branch) or below 2.11.6 (for 2.x branch)Check Version:
xfreerdp --versionVerify Fix Applied:
Confirm version is 3.5.0 or higher, or 2.11.6 or higher using 'xfreerdp --version'📡 Detection & Monitoring
Log Indicators:
- FreeRDP process crashes
- Abnormal memory access patterns in system logs
- Failed RDP connection attempts
Network Indicators:
- Unusual RDP traffic patterns
- Connection attempts to non-standard RDP ports
- Multiple failed authentication attempts
SIEM Query:
process.name:"xfreerdp" OR process.name:"wfreerdp" AND (event.action:"crash" OR memory.usage > threshold)🔗 References
- https://github.com/FreeRDP/FreeRDP/pull/10077
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cp4q-p737-rmw9
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/
- https://github.com/FreeRDP/FreeRDP/pull/10077
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cp4q-p737-rmw9
- https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/
