Bug 2078485 (CVE-2022-41860) - CVE-2022-41860 freeradius: Crash on unknown option in EAP-SIM
Summary: CVE-2022-41860 freeradius: Crash on unknown option in EAP-SIM
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-41860
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2078486 2151704 2151705
Blocks: 2078489 2160789
TreeView+ depends on / blocked
 
Reported: 2022-04-25 13:03 UTC by Pedro Sampaio
Modified: 2023-05-16 14:33 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-05-16 14:33:53 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:2166 0 None None None 2023-05-09 07:13:36 UTC
Red Hat Product Errata RHSA-2023:2870 0 None None None 2023-05-16 08:23:14 UTC

Description Pedro Sampaio 2022-04-25 13:03:38 UTC 
When an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.

References:

https://freeradius.org/security/

Upstream fix:

https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a
Comment 1 Pedro Sampaio 2022-04-25 13:03:52 UTC 
Created freeradius tracking bugs for this issue:

Affects: fedora-all [bug 2078486]
Comment 5 errata-xmlrpc 2023-05-09 07:13:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2166 https://access.redhat.com/errata/RHSA-2023:2166
Comment 6 errata-xmlrpc 2023-05-16 08:23:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2870 https://access.redhat.com/errata/RHSA-2023:2870
Comment 7 Product Security DevOps Team 2023-05-16 14:33:52 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-41860
Note You need to log in before you can comment on or make changes to this bug.