Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in freeradius's EAP-SIM module. The server copies the client-supplied EAP identity into an internal key-derivation structure without bounding its length against the destination field, and the resulting length is then used unchecked when deriving session keys, copying attacker-controlled data past the end of a fixed-size stack buffer. An unauthenticated client exchanging EAP-SIM messages with a server that has the module enabled can trigger this to crash the RADIUS server process.