PT-2022-26103 · Unknown+9 · Freeradius+8

Alandekok · Published 2022-04-22 · Updated 2025-06-26 · CVE-2022-41860

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions freeradius (affected versions not specified)

Description The issue occurs when an EAP-SIM supplicant sends an unknown SIM option to the server. The server attempts to look up this option in its internal dictionaries, which fails. However, the SIM code does not check for this failure and instead dereferences a NULL pointer, causing the server to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALSA-2023:2166

ALSA-2023:2870

ALT-PU-2022-2505

AZL-13062

CESA-2023_2870

CVE-2022-41860

DLA-3342-1

DLA-4232-1

MGASA-2022-0482

OESA-2022-2165

OESA-2023-1022

OPENSUSE-SU-2022_4622-1

OPENSUSE-SU-2022_4626-1

OPENSUSE-SU-2024:13386-1

RHSA-2023:2166

RHSA-2023:2870

RHSA-2023_2166

RHSA-2023_2870

SUSE-SU-2022:4620-1

SUSE-SU-2022:4621-1

SUSE-SU-2022:4622-1

SUSE-SU-2022:4626-1

SUSE-SU-2023:0124-1

SUSE-SU-2023:0135-1

USN-5785-1

Affected Products

Alt Linux

Almalinux

Centos

Debian

Freeradius

Linuxmint

Red Hat

Suse

Ubuntu

References · 68

• https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64a · Patch
• https://errata.almalinux.org/9/ALSA-2023-2166.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-41860 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5785-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/GZM4O5MGLKNOE2SSXAXQNL5DSII556QA · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4622-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-2870.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41860 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0135-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1022 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:2870 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-2165 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-2166.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41861 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13386-1 · Vendor Advisory