CVE-2023-7250: Iperf3: possible denial of service
A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.
Other sources
Reference: http://localhost:5600/static/?#/asmticket/102084
Original advisory details: Jorge Sancho Larraz discovered that iperf3 did not properly manage certain inputs, which could cause the server process to stop responding, waiting for input on the control connection. A remote attacker could possibly use this issue to cause a denial of service. (LP: #2038654)
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-7250?
CVE-2023-7250 is classified as a medium severity vulnerability.
How do I fix CVE-2023-7250?
To fix CVE-2023-7250, upgrade iperf to version 3.15 or later.
What systems are affected by CVE-2023-7250?
CVE-2023-7250 affects iperf versions prior to 3.15 on various Red Hat Enterprise Linux versions.
What is the impact of CVE-2023-7250?
CVE-2023-7250 can cause the iperf server to hang indefinitely when receiving insufficient data from a client.
Can CVE-2023-7250 be exploited remotely?
Yes, CVE-2023-7250 can be exploited by a malicious or malfunctioning client sending less data than expected.