Impact

Denial of service, freeze and memory consumption. Triggered by the dissection of a malicious Radius packet (network / pcap)

Patches

Patched in 2.4.1+

Workarounds

Any of those workaround fixes the issue. It is not required to apply several

• Disable Radius dissection:

split_layers(UDP, Radius)

• Disable Radius module:

This patch must be called before loading the Scapy module. For console usage, it can be added to ~/.scapy_startup.py in order to be run before the load of the layers.

from scapy.config import conf
conf.load_layers.remove('radius')

For more information

If you have any questions or comments about this advisory:

• Open an issue in scapy's GitHub repository