# Remote ASLR Leak in Microsoft's RDP Client through Printer Cache Registry (CVE-2021-38665)

Malicious RDP server sends non-null-terminated PrinterName in DR_PRN_ADD_CACHEDATA, leaking heap vtable pointers into client registry and back to server, breaking mstscax.dll ASLR.

- Payout: $1,000
- Severity: high
- Program: Microsoft
- Credited: Valentino Ricotta
- Disclosed: 2021-12-10
- CVE: CVE-2021-38665
- Write-up quality: 8/10
- Original: https://thalium.github.io/blog/posts/leaking-aslr-through-rdp-printer-cache-registry/
- Library page: https://bugbountylibrary.com/r/blog%3Athalium-github-io-blog-posts-leaking-aslr-through-rdp-printer-cache-registry
- Tags: domain:desktop impact:data-leak kind:bounty platform:blog sev:high tech:windows technique:fuzzing technique:reverse-engineering technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** mstsc.exe / mstscax.dll RDPDR printer sub-protocol
**Root cause:** Server-controlled PrinterName wide string is not required to be null-terminated and is passed directly to RegCreateKeyExW, which reads past the buffer until a double null byte, copying adjacent heap into the registry key name.
**Steps:**
1. Open RDPDR static virtual channel via WTSVirtualChannelOpenEx.
2. Send DR_PRN_ADD_CACHEDATA PDU with PrintNameLen=0x2a but PrinterName lacking 0x00 0x00 terminator, e.g. `Brother DCP-1000 USB abcd`.
3. Client calls W32DrPRN::AddPrinterCacheInfo -> RegCreateKeyExW, creating key whose name includes trailing heap bytes (vtable pointer).
4. Repeat 32x to raise leak probability.
5. Corrupt Microsoft::Windows::RDS::Graphics dynamic channel to force client reconnect.
6. On RDPDR re-init, client sends DR_PRN_DEVICE_ANNOUNCE containing the polluted key names back to server.
7. Scan TermService svchost memory for `Brother` crib, extract pointer, subtract known vtable offset to get mstscax.dll base.
**How found:** During heavy RDPDR fuzzing the client persistently consumed huge memory on startup; Procmon showed iteration over garbage keys under HKCU\...\AddIns\RDPDR. Correlating registry ops in mstscax.dll with the printer sub-protocol spec revealed DR_PRN_ADD_CACHEDATA controls the key name, and noticing unusually long key names hinted at missing null-termination.
**Exploitation:** Attacker runs a malicious RDP server; victim connects. Server writes crafted printer cache PDUs, forcing heap pointers into HKCU registry keys. By corrupting the Graphics channel the client auto-reconnects, and during RDPDR initialization the client announces devices (including polluted key names) back to the server, delivering the ASLR leak. Attacker reads it from server-side svchost memory.
**Escalation:** Leak is a building block to defeat ASLR for a subsequent memory-corruption exploit against the RDP client; multiple leaks increase reliability.
**Insight:** Fuzzer side effects on persistent state (registry, files, config) can reveal primitives that crashes never show; when a server-controlled string reaches a Win32 API expecting null-termination, check whether the length field is enforced and whether adjacent heap gets copied into an observable sink like a registry key name.