FreeRDP Use-After-Free Vulnerability in DRDYNVC Channel Callback via Race Condition

A use-after-free vulnerability has been identified in FreeRDP versions prior to 3.22.0. This vulnerability arises from improper synchronization of channel callback access in the DRDYNVC client. A malicious RDP server can exploit this issue by sending DYNVC_DATA and DYNVC_CLOSE messages simultaneously, creating a race condition. This leads to a heap-use-after-free situation in the DRDYNVC client thread, which could potentially allow for remote code execution or cause a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a heap-use-after-free error in the DRDYNVC client thread, which can lead to a segmentation fault or abort in the connected RDP client. However, this vulnerability could also be exploited to execute arbitrary code remotely, as demonstrated by a proof-of-concept exploit.

Reproduction

The vulnerability can be reproduced by connecting to a malicious RDP server using a FreeRDP client version 3.21.0 or earlier. Once connected, the server can send DYNVC_DATA and DYNVC_CLOSE messages concurrently on the same channel ID. This can be automated with a self-contained C harness that replicates the channel callback access patterns, creating a race condition that the vulnerability is named after.

Remediation

Users can upgrade to FreeRDP version 3.22.0 or later, where this vulnerability has been fixed.