CVE-2024-32660: 
NixOS vulnerability analysis and mitigation

CVE-2024-32660 affects FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). The vulnerability was discovered in versions prior to 3.5.1, where a malicious server can crash the FreeRDP client by sending invalid huge allocation size (GitHub Advisory). The issue was disclosed on April 23, 2024, and affects both the 2.x and 3.x series of FreeRDP up to versions 2.11.6 and 3.5.0 respectively.

The vulnerability is classified as a resource allocation issue (CWE-770) where the application fails to properly handle memory allocation requests. The CVSS v3.1 base score is 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that the vulnerability can be exploited remotely with no privileges or user interaction required (NVD).

When exploited, this vulnerability allows an attacker to crash the FreeRDP client through a denial of service condition by sending maliciously crafted data that triggers invalid huge allocation size. The impact is limited to availability, with no direct impact on confidentiality or integrity of the system (GitHub Advisory).

The vulnerability can be triggered by a malicious RDP server sending specially crafted data to the client. The attack vector is network-based and requires no special privileges or user interaction, making it relatively straightforward to exploit (NVD).

The vulnerability has been patched in FreeRDP versions 2.11.7 and 3.5.1. Users are advised to upgrade to these versions or later. The fix involves changes to the zgfx_decompress function to properly handle allocation sizes. No workarounds are available for unpatched versions (GitHub Advisory, Fedora Update).