REDHAT-BUG-2078485: Medium severity FreeRADIUS freeradius vulnerability
Published Apr 25, 2022
·Updated
When an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.
References:
https://freeradius.org/security/
Upstream fix:
https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a
Affected Software
1 affected component
FreeRADIUS freeradius
Event History
Apr 25, 2022
Data Sourced
via Red Hat·01:03 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What does an attacker need to do to trigger the crash?
The attacker needs to send an EAP-SIM request containing an unknown SIM option to the FreeRADIUS server. The failed internal dictionary lookup is then dereferenced as a NULL pointer, causing the server to crash.
2
What is the practical impact of successful exploitation?
Successful exploitation causes the FreeRADIUS server to crash, resulting in a denial of service.