gnome-remote-desktop vulnerabilities

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.

In gnome-remote-desktop as shipped in Red Hat Enterprise Linux, when the daemon runs in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler. This allows an unauthenticated remote attacker to open many parallel pre-authentication connections, exhausting resources and preventing legitimate users from establishing RDP sessions.

A flaw in gnome-remote-desktop allows an unauthenticated attacker to exhaust system resources and repeatedly crash the process. After many attacks, a resource leak may prevent gnome-remote-desktop from opening files even after a systemd restart.