REDHAT-BUG-2572339: High severity vulnerability
A flaw was found in freeradius's EAP-SIM module. The server copies the client-supplied EAP identity into an internal key-derivation structure without bounding its length against the destination field, and the resulting length is then used unchecked when deriving session keys, copying attacker-controlled data past the end of a fixed-size stack buffer. An unauthenticated client exchanging EAP-SIM messages with a server that has the module enabled can trigger this to crash the RADIUS server process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRADIUS servers with the EAP-SIM module enabled are exposed. An unauthenticated client that can exchange EAP-SIM messages with the server can trigger the flaw.
What is the practical impact of exploitation?
An attacker can cause the RADIUS server process to crash by supplying a crafted EAP identity. The provided information describes a denial-of-service impact.