Hi,

The following vulnerability was published for gnome-remote-desktop.

CVE-2025-5024[0]:
| A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop
| listens for RDP connections, an unauthenticated attacker can exhaust
| system resources and repeatedly crash the process. There may be a
| resource leak after many attacks, which will also result in gnome-
| remote-desktop no longer being able to open files even after it is
| restarted via systemd.

At this point in time there is not really much information available
for this apart the first reference from Red Hat[1].

Quoting from there:
| [...] This issue is different and I don't know anything yet. It has
| not been reported to GNOME Security.
|
| This bug is only two days old, though. I guess we'll have more
| information soon.

so guess we will have to wait a bit to get more information.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-5024
https://www.cve.org/CVERecord?id=CVE-2025-5024
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2367717

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

On Sun, 25 May 2025 at 16:13:13 +0200, Salvatore Bonaccorso forwarded:
the local LAN to cause a denial of service via resource exhaustion, but
it seems like it's only a denial of service and not something more
serious, and it's only exploitable by an attacker who can contact the
remote desktop server's RDP port. That's contrary to g-r-d's intended
security model, hence a CVE, but I wouldn't want to expose a protocol as
powerful as RDP onto untrusted networks *anyway*.

The typical use-case that I would expect for gnome-remote-desktop is
that a Debian GNOME desktop system enables gnome-remote-desktop, and a
client system on the same LAN (Debian or not, and GNOME or not)
remote-controls that system via a RDP client.

A mitigation is to firewall the desktop system (firewalld or similar) so
that RDP is only exposed when on a trusted or at least mostly-trusted
WLAN, or to only enable gnome-remote-desktop temporarily when it is
needed and disable it afterwards.

There is a merge request open upstream (linked above) but it hasn't been
merged and has some known issues, and it's a significant code change (it
adds a complete implementation of connection counting and throttling).

     smcv

Hi Simon,

Thanks for this update. I have marked the issue as no-dsa in the
security-tracker, and agreed if you have fix for trixie which is ready
to go in and feel confident about it then good otherwise it should not
be a showstopper defintively.

Regards,
Salvatore