Security readout for executives and security teams
Plain-English summary
FreeBSD systems using the libradius library may be crashed by malformed RADIUS messages from a malicious client or server. The business impact is availability: affected authentication-related services could stop responding until recovered. The public bundle does not provide CVSS, confirmed exploitation, or detailed operational impact.
Executive priority
Prioritize remediation where RADIUS availability supports authentication, network access, or operational control paths. Treat as moderate urgency unless local exposure is broad or service downtime would materially disrupt operations.
Technical view
CVE-2021-29629 is a missing message validation issue in FreeBSD libradius(3). A malicious RADIUS client can trigger denial of service in vulnerable servers, and a malicious RADIUS server can trigger denial of service in vulnerable clients. Affected FreeBSD releases are fixed at 13.0-RELEASE p1, 12.2-RELEASE p7, and 11.4-RELEASE p10.
Likely exposure
Exposure is most likely on FreeBSD hosts or products using FreeBSD libradius for RADIUS client or server functionality. The cited affected releases are FreeBSD 13.0-RELEASE before p1, 12.2-RELEASE before p7, and 11.4-RELEASE before p10.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. The described attacker position is a malicious RADIUS client targeting a vulnerable server, or a malicious RADIUS server targeting a vulnerable client. The publicly provided impact is denial of service only.
Researcher notes
Evidence is limited to the CVE description and vendor advisories listed in the bundle. No CVSS, CWE, proof-of-concept, or exploitation confirmation is provided. Avoid assuming affected third-party products beyond vendor advisories and validated component use.
Mitigation direction
- Upgrade affected FreeBSD releases to the documented fixed patch level or later.
- Check FreeBSD-SA-21:12.libradius for vendor-supported update guidance.
- Identify vendor appliances or products that may embed FreeBSD libradius.
- Review NetApp advisory NTAP-20210713-0003 for product-specific guidance if applicable.
Validation and detection
- Inventory FreeBSD systems running 13.0, 12.2, or 11.4 release branches.
- Confirm patch levels meet 13.0-p1, 12.2-p7, or 11.4-p10 or later.
- Identify services or applications linked against libradius(3).
- Check vendor advisories for embedded or packaged FreeBSD components.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-29629 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://security.freebsd.org/advisories/FreeBSD-SA-21:12.libradius.ascCVE reference · x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210713-0003/CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.