FreeRDP Kerberos Double-Free Vulnerability Leading to Crash

A double-free vulnerability has been identified in FreeRDP versions prior to 3.24.2, specifically within the Kerberos security context functions. This vulnerability can cause a crash in FreeRDP clients on systems where Kerberos is configured, such as Samba Active Directory members or with krb5 for NFS. The issue arises during the Network Level Authentication (NLA) connection teardown, following a failed authentication attempt, which triggers the crash. The vulnerability was introduced with Kerberos support in FreeRDP 3.x and is present in all 3.x releases with Kerberos enabled.

Impact

Exploitation of this vulnerability leads to a heap double-free condition, causing a crash of the FreeRDP client. However, such heap vulnerabilities can often be exploited to execute arbitrary code under certain conditions.

Remediation

Users can upgrade to FreeRDP version 3.24.2 or later to address this vulnerability.