Read the docs
TI-2022-20209 Aliases CVE-2022-41860GHSA-cfm7-f9p7-7m2w

NULL pointer dereference in freeradius

Priority MEDIUM 41CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-476.

Summary

In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01213 68th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—freeradiusAll versions from 0.9.3 to 3.0.25—No fix listedCNA
  • freeradius Vendor— Affected All versions from 0.9.3 to 3.0.25 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*0.9.3 – 3.0.25Vulnerablefreeradius
  • cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:* Versions 0.9.3 – 3.0.25 Vulnerable ·freeradius

Remediation

Red Hat 2 advisories

  • RHSA-2023:2870 Released 2023-05-16 · Red Hat rating Moderate
    freeradius:3.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) freeradius-3.0.20-14.module+el8.8.0+17558+3f8a93b9.aarch64::freeradius:3.0, freeradius-3.0.20-14.module+el8.8.0+17558+3f8a93b9.ppc64le::freeradius:3.0, freeradius-3.0.20-14.module+el8.8.0+17558+3f8a93b9.s390x::freeradius:3.0 +47
  • RHSA-2023:2166 Released 2023-05-09 · Red Hat rating Moderate
    freeradius security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) freeradius-3.0.21-37.el9, freeradius-devel-3.0.21-37.el9, freeradius-doc-3.0.21-37.el9 +4
    • Red Hat Enterprise Linux CRB (v. 9) freeradius-mysql-3.0.21-37.el9, freeradius-perl-3.0.21-37.el9, freeradius-postgresql-3.0.21-37.el9 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:2870
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:2166
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2023:2166

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41860
  2. 2026-10-03 Alias added: GHSA-cfm7-f9p7-7m2w

References

Patch 2

  • TI-2019-07466 Race condition in freeradius CVSS 3.1HIGH 7.0
  • TI-2024-03351 RADIUS Protocol under RFC2865 is vulnerable to forgery attacks. CVSS 3.1CRITICAL 9.0
  • TI-2019-08409 FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing… CVSS 3.0CRITICAL 9.8
  • TI-2017-08061 An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in… CVSS 3.0CRITICAL 9.8
  • TI-2017-08066 An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in… CVSS 3.0CRITICAL 9.8
  • TI-2017-06599 The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x… CVSS 3.0CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences