CVE-2024-32658
📋 TL;DR
CVE-2024-32658 is an out-of-bounds read vulnerability in FreeRDP clients prior to version 3.5.1. This vulnerability could allow attackers to read sensitive memory contents, potentially leading to information disclosure or as a stepping stone for further attacks. Anyone using FreeRDP-based clients (like xfreerdp, wlfreerdp) in affected versions is at risk.
💻 Affected Systems
- FreeRDP
- Applications using FreeRDP library (e.g., xfreerdp, wlfreerdp, Remmina with FreeRDP backend)
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Freerdp by Freerdp
Freerdp by Freerdp
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if combined with other vulnerabilities, or sensitive information disclosure from memory.
Likely Case
Application crash (denial of service) or limited information disclosure from adjacent memory.
If Mitigated
No impact if patched or if vulnerable clients are not used to connect to untrusted RDP servers.
🎯 Exploit Status
Exploitation requires a malicious RDP server that a victim connects to. No authentication bypass needed beyond convincing user to connect.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.1
Vendor Advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vpv3-m3m9-4c2v
Restart Required: Yes
Instructions:
1. Update FreeRDP to version 3.5.1 or later using your package manager (e.g., apt update && apt upgrade freerdp2 on Debian/Ubuntu). 2. Restart any applications using FreeRDP. 3. For source installations: git clone, checkout tag 3.5.1, compile and install.
🔧 Temporary Workarounds
Network Segmentation
allRestrict FreeRDP clients to only connect to trusted, internal RDP servers.
Application Whitelisting
allBlock execution of vulnerable FreeRDP client binaries until patched.
🧯 If You Can't Patch
- Discontinue use of FreeRDP clients for connecting to untrusted or external RDP servers.
- Switch to alternative RDP clients (e.g., Microsoft Remote Desktop, rdesktop if not vulnerable) temporarily.
🔍 How to Verify
Check if Vulnerable:
Check FreeRDP version: xfreerdp --version or freerdp3 --version. If version is below 3.5.1, it's vulnerable.Check Version:
xfreerdp --version 2>&1 | head -1Verify Fix Applied:
After update, run xfreerdp --version and confirm version is 3.5.1 or higher.📡 Detection & Monitoring
Log Indicators:
- Application crashes of FreeRDP clients
- Unexpected memory access errors in system logs
Network Indicators:
- RDP connections to unknown or suspicious servers from FreeRDP clients
SIEM Query:
source="*freerdp*" AND (event="crash" OR event="segfault")🔗 References
- https://github.com/FreeRDP/FreeRDP/commit/1a755d898ddc028cc818d0dd9d49d5acff4c44bf
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vpv3-m3m9-4c2v
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/
- https://oss-fuzz.com/testcase-detail/4852534033317888
- https://oss-fuzz.com/testcase-detail/6196819496337408
- https://github.com/FreeRDP/FreeRDP/commit/1a755d898ddc028cc818d0dd9d49d5acff4c44bf
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vpv3-m3m9-4c2v
- https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/
- https://oss-fuzz.com/testcase-detail/4852534033317888
- https://oss-fuzz.com/testcase-detail/6196819496337408
