CVE-2023-38403

iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.

iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.

Iperf is a tool for active measurements of the maximum achievable bandwidth on IP networks. It supports tuning of various parameters related to timing, protocols, and buffers.

Security Fix(es):

iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.(CVE-2023-38403)

iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

Security Fix(es):

• iperf3: memory allocation hazard and crash (CVE-2023-38403)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

Security Fix(es):

• iperf3: memory allocation hazard and crash (CVE-2023-38403)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.

It was discovered that iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field (CVE-2023-38403).

These are all security issues fixed in the iperf-3.14-1.1 package on the GA media of openSUSE Tumbleweed.

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

Security Fix(es):

• iperf3: memory allocation hazard and crash (CVE-2023-38403)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

Security Fix(es):

• iperf3: memory allocation hazard and crash (CVE-2023-38403)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for iperf fixes the following issues:

• CVE-2023-38403: Fixed integer overflow leading to heap buffer overflow (bsc#1213430).

This update for iperf fixes the following issues:

• update to 3.15 (bsc#1215662, ESNET-SECADV-2023-0002):

  • Several bugs that could allow the iperf3 server to hang waiting for input on the control connection has been fixed (ESnet Software Security Advisory ESNET-SECADV-2023-0002)
  • A bug that caused garbled output with UDP tests on 32-bit hosts has been fixed (PR #1554, PR #1556). This bug was introduced in iperf-3.14.
  • A bug in counting UDP messages has been fixed

• update to 3.14 (bsc#1213430, CVE-2023-38403):

  • fixes a memory allocation hazard that allowed a remote user to crash an iperf3 process
  • see https://downloads.es.net/pub/iperf/esnet-secadv-2023-0001.txt.asc

• update to 3.13:

  • Added missing bind_dev getter and setter.
  • a fix for A resource leak bug in function iperf_create_pidfile (#1443)
  • doc: Fix copy-and-paste error leading to wrong error message
  • Fix crash on rcv-timeout with JSON logfile

• update to 3.12:

  • cJSON has been updated to version 1.7.15 (#1383).
  • The --bind <host>%<dev> option syntax now works properly (#1360 /
  • A server-side file descriptor leak with the --logfile option has been fixed (#1369 / #1360 / #1369 / #1389 / #1393).
  • A bug that caused some large values from TCP_INFO to be misprinted as negative numbers has been fixed (#1372).
  • Using the -k or -n flags with --reverse no longer leak into future tests (#1363 / #1364).
  • There are now various debug level options available with the --debug option. These can be used to adjust the amount of debugging output (#1327).
  • A new --snd-timeout option has been added to set a termination timeout for idle TCP connections (#1215 / #1282).
  • iperf3 is slightly more robust to out-of-order packets during UDP connection setup in --reverse mode (#914 / #1123 / #1182 / #1212 /
  • iperf3 will now use different ports for each direction when the --cport and --bdir options are set (#1249 / #1259).
  • The iperf3 server will now exit if it can't open its log file
  • Various help message and output fixes have been made (#1299 /
  • Various compiler warnings have been fixed (#1211 / #1316).
  • Operation of bootstrap.sh has been fixed and simplified (#1335 /
  • Flow label support / compatibility under Linux has been improved
  • Various minor memory leaks have been fixed (#1332 / #1333).
  • A getter/setter has been added for the bind_port parameter (--cport option). (#1303, #1305)
  • Various internal documentation improvements (#1265 / #1285 / #1304).

• update to 3.11:

  • Update links to Discussions in documentation
  • Fix DSCP so that TOS = DSCP * 4 (#1162)
  • Fix --bind-dev for TCP streams (#1153)
  • Fix interface specification so doesn't overlap with IPv6 link-local addresses for -c and -B (#1157, #1180)
  • Add get/set test_unit_format function declaration to iperf_api.h
  • Auto adjustment of test-end condition for file transfers (-F), if no end condition is set, it will automatically adjust it to file size in bytes
  • Exit if idle time expires waiting for a connection in one-off mode (#1187, #1197)
  • Support zerocopy by reverse mode (#1204)
  • Update help and manpage text for #1157, support bind device
  • Consistently print target_bandwidth in JSON start section (#1177)
  • Test bitrate added to JSON output (#1168)
  • Remove fsync call after every write to receiving --file (#1176, #1159)
  • Update documentation for -w (#1175)
  • Fix for #952, different JSON object names for bidir reverse channel

• update to 3.10.1:

  • Fixed a problem with autoconf scripts that made builds fail in some environments (#1154 / #1155).
  • GNU autoconf 2.71 or newer is now required to regenerate iperf3's configure scripts.

• update to 3.10:

  • Fix a bug where some --reverse tests didn't terminate (#982 / #1054).
  • Responsiveness of control connections is slightly improved (#1045 / #1046 / #1063).
  • The allowable clock skew when doing…

It was discovered that iperf3 did not properly manage certain inputs, which could lead to a crash. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-38403)

Jorge Sancho Larraz discovered that iperf3 did not properly manage certain inputs, which could cause the server process to stop responding, waiting for input on the control connection. A remote attacker could possibly use this issue to cause a denial of service. (LP: #2038654)

USN-6431-1 fixed a vulnerability in iperf3. This update provides the corresponding update for Ubuntu 22.04 LTS and Ubuntu 23.04.

Original advisory details:

It was discovered that iperf3 did not properly manage certain inputs, which could lead to a crash. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-38403)