From 632a7498f834ff07ecf7a3dd604c06f6b89dd768 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Thu, 4 Jun 2026 10:00:02 +0200 Subject: [PATCH] eap-aka: Only accept AKA-Synchronization-Failure if expected This fixes a NULL-pointer dereference if the client sends such an error before the server issued a challenge and allocated this->rand. Fixes: 26e246769224 ("ported EAP-AKA branch into trunk") Fixes: 4735965fc048 ("EAP servers check if the received EAP message was expected") Fixes: CVE-2026-78126 --- src/libcharon/plugins/eap_aka/eap_aka_server.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/libcharon/plugins/eap_aka/eap_aka_server.c b/src/libcharon/plugins/eap_aka/eap_aka_server.c index 89e51c733bec..1140fea57907 100644 --- a/src/libcharon/plugins/eap_aka/eap_aka_server.c +++ b/src/libcharon/plugins/eap_aka/eap_aka_server.c @@ -505,6 +505,12 @@ static status_t process_synchronize(private_eap_aka_server_t *this, simaka_attribute_t type; chunk_t data, auts = chunk_empty; + if (this->pending != AKA_CHALLENGE) + { + DBG1(DBG_IKE, "received %N, but not expected", + simaka_subtype_names, AKA_SYNCHRONIZATION_FAILURE); + return FAILED; + } if (this->synchronized) { DBG1(DBG_IKE, "received %N, but peer did already resynchronize", -- 2.43.0