CVE-2022-41860

In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://freeradius.org/security/	Patch Vendor Advisory
https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a	Patch Third Party Advisory
https://freeradius.org/security/	Patch Vendor Advisory
https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:23

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-01-17 18:15

Updated : 2025-04-07 17:15

NVD link : CVE-2022-41860

Mitre link : CVE-2022-41860

CVE.ORG link : CVE-2022-41860

JSON object : View

Products Affected

freeradius

freeradius

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2022-41860", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-01-17T18:15:11.387", "references": [{"url": "https://freeradius.org/security/", "tags": ["Patch", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a", "tags": ["Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://freeradius.org/security/", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash."}, {"lang": "es", "value": "En freeradius, cuando un solicitante de EAP-SIM env\u00eda una opci\u00f3n SIM desconocida, el servidor intentar\u00e1 buscar esa opci\u00f3n en los diccionarios internos. Esta b\u00fasqueda fallar\u00e1, pero el c\u00f3digo SIM no verificar\u00e1 ese error. En su lugar, eliminar\u00e1 la referencia a un puntero NULL y provocar\u00e1 que el servidor falle."}], "lastModified": "2025-04-07T17:15:34.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A19F4F3-C514-4FDC-B3A3-0E688BD43247", "versionEndIncluding": "3.0.25", "versionStartIncluding": "0.9.3"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}