REDHAT-BUG-2572340: High severity vulnerability
A flaw was found in freeradius's EAP-FAST module. The SessionTicket callback invoked during the TLS ClientHello phase of the EAP-FAST handshake validates the PAC-Opaque length using mismatched integer types, allowing an attacker-supplied value to underflow and bypass the check. The callback then decrypts attacker-controlled ciphertext into a fixed-size buffer before the authentication tag is verified, so a crafted ClientHello can write data past the end of a stack buffer. A remote, unauthenticated client speaking EAP-FAST to a server with the module enabled can trigger this to crash the RADIUS server process before any credential exchange.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRADIUS servers with the EAP-FAST module enabled are exposed. A remote client that can initiate EAP-FAST authentication against the server can trigger the flaw.
Does an attacker need valid credentials or an existing session?
No. The issue can be triggered by an unauthenticated client during the TLS ClientHello phase of the EAP-FAST handshake, before credential exchange.
What is the likely operational impact of an exploit attempt?
A crafted ClientHello can write past a stack buffer and crash the RADIUS server process. The provided information specifically confirms denial of service through a server-process crash.