CVE-2026-127029
Description
A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).
Statement
This vulnerability is rated as an Important severity flaw because an unauthenticated remote client can cause a denial of service by crashing the RADIUS server daemon over the network without requiring valid authentication credentials. In Red Hat Enterprise Linux environments, FreeRADIUS deployments are only susceptible if the EAP-SIM authentication submodule is explicitly enabled within the EAP module configuration. Standard deployments that do not process SIM-based mobile network authentication are unaffected by this flaw.
Mitigation
Disable the EAP-SIM submodule in the FreeRADIUS configuration if SIM-based authentication is not required:
1. Edit `/etc/raddb/mods-available/eap` (or `/etc/raddb/mods-enabled/eap`) and comment out or remove the `sim` configuration block within the `eap` module definition:
# sim {
# }
2. Restart the FreeRADIUS service to apply the changes:
systemctl restart radiusd
Warning: Restarting or reloading the FreeRADIUS service will temporarily interrupt active RADIUS authentication requests. Clients relying on EAP-SIM authentication will no longer be able to authenticate.
Additionally, restrict RADIUS UDP traffic (ports 1812 and 1813) to trusted Network Access Server (NAS) IP addresses using firewall rules to limit exposure to untrusted networks.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Acknowledgements
Red Hat would like to thank s4cr00t (Alipay Security Team) for reporting this issue. Upstream acknowledges Glen Saunders as the original reporter.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
