Описание
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a Denial of Service (DoS) by sending repeated serial device creation requests when serial port redirection is enabled. Because FreeRDP fails to release previous communication handles before allocating new ones, the client application exhausts available file descriptors and terminates unexpectedly.
Отчет
This vulnerability is rated Moderate for Red Hat Enterprise Linux because the impact is confined to client-side denial of service and requires an explicit, non-default feature configuration. FreeRDP does not enable serial device redirection by default, meaning an attacker-controlled RDP server can only trigger descriptor exhaustion if the client session specifically opted into serial forwarding. Additionally, the flaw affects only availability without impacting system confidentiality or data integrity.
Меры по смягчению последствий
Limit FreeRDP process resources with ulimit/cgroup controls to contain memory exhaustion. Restrict clients/servers to trusted peers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | freerdp | Not affected | ||
| Red Hat Enterprise Linux 7 | freerdp | Affected | ||
| Red Hat Enterprise Linux 8 | freerdp | Affected | ||
| Red Hat Enterprise Linux 9 | freerdp | Affected | ||
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:94514 | 03.11.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.
FreeRDP before 3.32.0 fails to close prior serial handles in serial_pr ...
FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. Attackers can send repeated serial IRP_MJ_CREATE requests to accumulate descriptors and terminate the client at the CommReadFile FD_SETSIZE assertion.
Уязвимость функции serial_process_irp_create() RDP-клиента FreeRDP, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
5.9 Medium
CVSS3