CVE-2026-121412
개요
A flaw was found in FreeRDP. This vulnerability allows an authenticated remote client to cause a Denial of Service (DoS) by exhausting system memory on the proxy server. When intercepting Dynamic Virtual Channel (DVC) communications, the proxy does not enforce cumulative limits on reassembling fragmented messages. An attacker can exploit this by transmitting incomplete fragments with large declared message sizes, continuously consuming proxy heap memory and degrading service availability.
내용
This vulnerability is rated as having Moderate impact because it results solely in a denial of service condition without affecting the confidentiality or integrity of the host system. In typical Red Hat Enterprise Linux environments, FreeRDP is predominantly utilized as an RDP client rather than an intermediary proxy service, which significantly limits widespread exposure. Furthermore, exploitation requires an attacker to establish a valid client session through the proxy to drive memory exhaustion.
완화 방법
Restrict network access to the FreeRDP proxy service to trusted IP addresses or subnets using firewalld, preventing arbitrary clients from establishing sessions and consuming proxy heap memory:
1. Allow access only from trusted source networks to the proxy port (commonly TCP port 3389):
# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="3389" protocol="tcp" accept'
# firewall-cmd --reload
Warning: Reloading firewall rules may temporarily interrupt existing network sessions.
2. Operational Caveat: Limiting access strictly to authorized management subnets prevents untrusted clients from initiating RDP proxy connections, but it will block any legitimate clients connecting from outside the specified network ranges. If the proxy service is not required, terminate any standalone proxy instances.
CVSS (Common Vulnerability Scoring System) 점수 세부 사항
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
다음의 CVSS 지표 및 점수는 예비 정보로 검토 대상입니다.
CVSS v3 점수 분석
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| 기본 점수 | 6.5 | N/A | 6.5 |
| 공격 벡터 | Network | N/A | Network |
| 공격 복잡성 | Low | N/A | Low |
| 필요한 권한 | Low | N/A | Low |
| 사용자 상호 작용 | None | N/A | None |
| 범위 | Unchanged | N/A | Unchanged |
| 기밀성 | None | N/A | None |
| 무결성에 미치는 영향 | None | N/A | None |
| 가용성에 미치는 영향 | High | N/A | High |
벡터
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
취약점 이해 (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
