Описание
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the bs calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The subsequent out_frames modulo bs operation raises SIGFPE and terminates the server-side rdpsnd channel process. This vulnerability fixed in 3.28.0.
A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. An authenticated Remote Desktop Protocol (RDP) client can trigger a denial of service by sending a specially crafted DVI ADPCM frame. By advertising specific nBlockAlign and nChannels values, a division-by-zero error occurs in the rdpsnd_server_select_format function. This vulnerability leads to the termination of the server-side rdpsnd channel process, causing a denial of service.
Отчет
A divide-by-zero flaw was found in FreeRDP's rdpsnd audio channel server implementation. An authenticated remote RDP client can send malformed DVI ADPCM audio parameters (nBlockAlign=8, nChannels=2) during format selection in rdpsnd_server_select_format. This triggers an unhandled SIGFPE signal when calculating audio frames, crashing the server-side rdpsnd process and resulting in a denial of service for remote desktop audio capabilities.
Меры по смягчению последствий
To mitigate this issue, administrators can disable audio redirection on the FreeRDP server configuration if remote audio support is not strictly required.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | freerdp | Fix deferred | ||
| Red Hat Enterprise Linux 6 | freerdp | Not affected | ||
| Red Hat Enterprise Linux 7 | freerdp | Fix deferred | ||
| Red Hat Enterprise Linux 8 | freerdp | Fix deferred | ||
| Red Hat Enterprise Linux 9 | freerdp | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the `bs` calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The subsequent out_frames modulo `bs` operation raises SIGFPE and terminates the server-side rdpsnd channel process. This vulnerability fixed in 3.28.0.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the `bs` calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The subsequent out_frames modulo `bs` operation raises SIGFPE and terminates the server-side rdpsnd channel process. This vulnerability fixed in 3.28.0.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior ...
EPSS
6.5 Medium
CVSS3