CVE-2022-41860
Last modified
CVE-2022-41860 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. EPSS estimates a 1.17% chance of exploitation in the next 30 days.
Description
In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Freeradius | Freeradius | >= 0.9.3, <= 3.0.25 |
References
- https://freeradius.org/security/Patch, Vendor Advisory
- https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64aPatch, Third Party Advisory
- https://freeradius.org/security/Patch, Vendor Advisory
- https://github.com/FreeRADIUS/freeradius-server/commit/f1cdbb33ec61c4a64aPatch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-41860?
How severe is CVE-2022-41860?
How do I fix CVE-2022-41860?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-41855Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-41856Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-41857Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-41858A flaw was found in the Linux kernel. A NULL pointer derefer…7.1
- CVE-2022-41859In freeradius, the EAP-PWD function compute_password_element…7.5
- CVE-2022-4186Insufficient validation of untrusted input in Downloads in G…4.3
- CVE-2022-41861A flaw was found in freeradius. A malicious RADIUS client or…6.5
- CVE-2022-41862In PostgreSQL, a modified, unauthenticated server can send a…3.7
- CVE-2022-4187Insufficient policy enforcement in DevTools in Google Chrome…6.5
- CVE-2022-41870AP Manager in Innovaphone before 13r2 Service Release 17 all…7.2
- CVE-2022-41871SEPPmail through 12.1.17 allows command injection within the…8.8
- CVE-2022-41873Contiki-NG is an open-source, cross-platform operating syste…5.4
Are you affected by CVE-2022-41860?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST