FreeRDP Heap Use-After-Free Vulnerability in urb_select_interface Function

A heap-use-after-free vulnerability has been identified in FreeRDP versions prior to 3.22.0. The issue arises in the 'urb_select_interface' function, which can mistakenly free the device's MS configuration on error. However, subsequent code still attempts to dereference this freed memory, leading to a use-after-free condition in 'libusb_udev_select_interface'. This vulnerability can be exploited by a malicious server, causing a client-side crash and potentially allowing for code execution, depending on the behavior of the memory allocator and the layout of the heap.

Impact

Exploitation of this vulnerability causes a client-side crash and can lead to heap corruption. This type of memory corruption often allows for arbitrary code execution, depending on the behavior of the memory allocator and the surrounding heap layout.

Remediation

Users can upgrade to FreeRDP version 3.22.0 or later to address this vulnerability.