FreeRDP 3.31.0 plugs five server bugs, pre-auth RCE chain

FreeRDP 3.31.0 fixes five server-side vulnerabilities that Bynario reported, three of which the researchers chained into pre-authentication remote code execution. The release also addresses seventeen other security issues. Client-role FreeRDP is unaffected.

Projects that embed FreeRDP as an RDP server, notably GNOME Remote Desktop and KDE krdp, inherit the flaws. Those services are not on by default, so only machines an administrator has configured for remote desktop or remote login are exposed. Bynario said real-world reach of the specific RCE chain is therefore limited.

The critical entry point is a negotiation failure that is not treated as terminal. After rejecting a client's protocol offer the server leaves the socket open and then misreads the failure code as a protocol selection, dropping an unauthenticated peer into a security mechanism the server had disabled and the client never asked for. That bypass can set up an RDP connection used to paint the login screen, after which the remaining authenticated-session bugs become reachable before local user authentication completes.

One of those follow-on issues is an RDPGFX ResetGraphics path that discloses uninitialized heap contents. The other reported flaws likewise require an established RDP session once the negotiation bypass is in hand.

There is no 3.30.x point release. Distributions still on 3.30.0 or earlier need the 3.31.0 rebase or their own backports. Samuel Page of Bynario disclosed the findings on the oss-security list.