Cloudanix VulnDB

CVE-2023-7250

Medium · 5.3

CVSS

5.3

EPSS

0.9%

Published

Mar 18, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A network testing program can be made unresponsive to new requests when someone sends it incomplete information over the network.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

A malicious client can transmit less data than the iperf server protocol expects during a TCP/UDP/SCTP session, leaving the server blocked indefinitely in a receive state and unable to accept additional connections.

Why it matters to the business

Disruption of network performance testing and diagnostic services that depend on iperf, leading to degraded monitoring capabilities and potential operational delays in environments relying on these utilities.

How an attack unfolds

An attacker initiates a connection to an exposed iperf server and deliberately sends an incomplete data payload according to the expected protocol flow, causing the server to hang while awaiting the remainder of the data until the connection is closed by other means.

How to fix it

Upgrade esnet/iperf to commit 917d2f02188f6f4cdc443df7923a4bde72017d92 and powertop to version 2.14-1.el8. Apply server-side timeouts and input-length validation where custom builds are required.

How to confirm the fix worked

Confirm installed package or source revision matches the listed fixed versions; attempt a controlled partial-data connection and verify the server continues accepting new sessions without indefinite blocking.

Typical attack path

  1. Connect to the listening iperf server port using TCP, UDP, or SCTP
  2. Begin the performance test handshake but transmit fewer bytes than the server anticipates
  3. Keep the connection open to maintain the server thread or process in a blocked state
  4. Repeat against the same or additional servers to amplify denial of service

How to detect it

Review process listings and network connection tables for iperf instances stuck in receive-wait states; examine server logs for unusually long-lived sessions that never complete their data exchange.

What your security team should do

  • Apply the listed fixed versions to all iperf deployments without delay
  • Restrict network access to iperf ports to trusted management hosts only
  • Implement connection timeouts and resource limits around iperf server processes
  • Include iperf version checks in routine vulnerability scanning

The record

A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 iperf3 0 3.5-10.el8_10
AlmaLinux:9 iperf3 0 3.9-13.el9
Debian:11 iperf3 0 No fix
Debian:11 iperf3 0 3.9-1+deb11u2
Debian:12 iperf3 0 No fix
Debian:13 iperf3 0 3.15-1
Red Hat:enterprise_linux:8::appstream iperf3 0 0:3.5-10.el8_10
Red Hat:enterprise_linux:8::appstream iperf3-debuginfo 0 0:3.5-10.el8_10
Red Hat:enterprise_linux:8::appstream iperf3-debugsource 0 0:3.5-10.el8_10
Red Hat:enterprise_linux:9::appstream iperf3 0 0:3.9-13.el9
Red Hat:enterprise_linux:9::appstream iperf3-debuginfo 0 0:3.9-13.el9
Red Hat:enterprise_linux:9::appstream iperf3-debugsource 0 0:3.9-13.el9
Rocky Linux:9 iperf3 0 0:3.9-13.el9_5.1
Ubuntu:20.04:LTS iperf3 0 No fix
Ubuntu:22.04:LTS iperf3 0 No fix
Ubuntu:22.04:LTS iperf3 0 3.9-1+deb11u1ubuntu0.1
Ubuntu:24.04:LTS iperf3 0 3.16-1
Ubuntu:Pro:16.04:LTS iperf3 0 No fix
Ubuntu:Pro:16.04:LTS iperf3 0 3.0.11-1ubuntu0.1~esm2
Ubuntu:Pro:18.04:LTS iperf3 0 No fix
Ubuntu:Pro:18.04:LTS iperf3 0 3.1.3-1ubuntu0.1~esm1
Ubuntu:Pro:20.04:LTS iperf3 0 No fix
Ubuntu:Pro:20.04:LTS iperf3 0 3.7-3ubuntu0.1~esm1
Ubuntu:Pro:22.04:LTS iperf3 0 No fix

Related vulnerabilities