In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.
References
| Link | Resource |
|---|---|
| https://freeradius.org/security/ | Patch Vendor Advisory |
| https://freeradius.org/security/ | Patch Vendor Advisory |
| https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a | Patch Third Party Advisory |
| https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a | Patch Third Party Advisory |
Configurations
History
07 Apr 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | ||
| References | () https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a - Patch, Third Party Advisory | |
| References | () https://freeradius.org/security/ - Patch, Vendor Advisory |
Information
Published : 2023-01-17 18:15
Updated : 2025-04-07 17:15
NVD link : CVE-2022-41860
Mitre link : CVE-2022-41860
JSON object : View
Products Affected
freeradius
- freeradius
CWE
No CWE.