Kar Wei Loh

The issue arises from a buffer overflow vulnerability in the `rad packet recv` function, located in `opt/src/accel-pppd/radius/packet.c`. This vulnerability occurs because user input `len` is copied into a fixed buffer `&attr->val.integer` without any bound checks. When a client connects to the server and sends a large radius packet, this buffer overflow vulnerability can be triggered.

The issue is related to a memcpy buffer overflow in the `rad packet recv` function, located in `radius/packet.c`. This overflow occurs due to an overly-large `recvfrom` into a fixed buffer, causing a buffer overflow that overwrites arbitrary memory. The vulnerability can be remotely triggered by crafted client requests if the server connects with a malicious client.