CVE-2022-41860

In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.

In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service.

Security Fix(es):

When an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.

References:

https://freeradius.org/security/

Upstream fix:

https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a(CVE-2022-41860)

A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash.

References:

https://freeradius.org/security/

Upstream fix:

https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e(CVE-2022-41861)

Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service.

Security Fix(es):

When an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.

References:

https://freeradius.org/security/

Upstream fix:

https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a(CVE-2022-41860)

A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash.

References:

https://freeradius.org/security/

Upstream fix:

https://github.com/FreeRADIUS/freeradius-server/commit/0ec2b39d260e(CVE-2022-41861)

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

Security Fix(es):

• freeradius: Information leakage in EAP-PWD (CVE-2022-41859)

• freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860)

• freeradius: Crash on invalid abinary data (CVE-2022-41861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

Security Fix(es):

• freeradius: Information leakage in EAP-PWD (CVE-2022-41859)
• freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860)
• freeradius: Crash on invalid abinary data (CVE-2022-41861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.

Security Fix(es):

• freeradius: Information leakage in EAP-PWD (CVE-2022-41859)
• freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860)
• freeradius: Crash on invalid abinary data (CVE-2022-41861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Information leakage in EAP-PWD. (CVE-2022-41859) Crash on unknown option in EAP-SIM. (CVE-2022-41860) Crash on invalid abinary data. (CVE-2022-41861)

These are all security issues fixed in the freeradius-server-3.2.3-2.1 package on the GA media of openSUSE Tumbleweed.

This update for freeradius-server fixes the following issues:

• CVE-2022-41859: Fixes an information leakage in EAP-PWD (bsc#1206204).
• CVE-2022-41860: Fixes a crash on unknown option in EAP-SIM (bsc#1206205).
• CVE-2022-41861: Fixes a crash on invalid abinary data (bsc#1206206).
• move logrotate options into specific parts for each log as 'global' options will persist past and clobber global options in the main logrotate config (bsc#1180525)
• Fixed plaintext password entries in logfiles (bsc#1184016).

This update for freeradius-server fixes the following issues:

• CVE-2022-41859: Fixes an information leakage in EAP-PWD (bsc#1206204).
• CVE-2022-41860: Fixes a crash on unknown option in EAP-SIM (bsc#1206205).
• CVE-2022-41861: Fixes a crash on invalid abinary data (bsc#1206206).

This update for freeradius-server fixes the following issues:

• CVE-2022-41859: Fixes an information leakage in EAP-PWD (bsc#1206204).
• CVE-2022-41860: Fixes a crash on unknown option in EAP-SIM (bsc#1206205).
• CVE-2022-41861: Fixes a crash on invalid abinary data (bsc#1206206).

This update for freeradius-server fixes the following issues:

• CVE-2022-41859: Fixes an information leakage in EAP-PWD (bsc#1206204).

• CVE-2022-41860: Fixes a crash on unknown option in EAP-SIM (bsc#1206205).

• CVE-2022-41861: Fixes a crash on invalid abinary data (bsc#1206206).

• rebuild against the new net-snmp (jsc#SLE-11203).

This update for freeradius-server fixes the following issues:

• CVE-2022-41859: Fixed an issue in EAP-PWD that could leak information about the password, which could facilitate dictionary attacks (bsc#1206204).
• CVE-2022-41860: Fixed a crash in servers with EAP_SIM manually configured, which could be triggered via a malformed SIM option (bsc#1206205).
• CVE-2022-41861: Fixed a server crash that could be triggered by sending malformed data from a system in the RADIUS circle of trust (bsc#1206206).

This update for freeradius-server fixes the following issues:

• CVE-2022-41859: Fixed an issue in EAP-PWD that could leak information about the password, which could facilitate dictionary attacks (bsc#1206204).
• CVE-2022-41860: Fixed a crash in servers with EAP_SIM manually configured, which could be triggered via a malformed SIM option (bsc#1206205).
• CVE-2022-41861: Fixed a server crash that could be triggered by sending malformed data from a system in the RADIUS circle of trust (bsc#1206206).

It was discovered that FreeRADIUS incorrectly handled multiple EAP-pwd handshakes. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-17185)

Shane Guan discovered that FreeRADIUS incorrectly handled memory when checking unknown SIM option sent by EAP-SIM supplicant. An attacker could possibly use this issue to cause a denial of service on the server. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-41860)

It was discovered that FreeRADIUS incorrectly handled memory when processing certain abinary attributes. An attacker could possibly use this issue to cause a denial of service on the server. (CVE-2022-41861)