diff --git a/SPECS/iperf3/CVE-2025-54349.patch b/SPECS/iperf3/CVE-2025-54349.patch new file mode 100644 index 00000000000..7867866f99d --- /dev/null +++ b/SPECS/iperf3/CVE-2025-54349.patch @@ -0,0 +1,93 @@ +From 79d560d64d50497717847bb2c12ede1f4a8ea7e9 Mon Sep 17 00:00:00 2001 +From: Sarah Larsen +Date: Wed, 25 Jun 2025 15:11:03 +0000 +Subject: [PATCH] Fix off-by-one heap overflow in auth. + +Reported by Han Lee (Apple Information Security) +CVE-2025-54349 +--- + src/iperf_auth.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/src/iperf_auth.c b/src/iperf_auth.c +index 72e85fc..86b4eba 100644 +--- a/src/iperf_auth.c ++++ b/src/iperf_auth.c +@@ -288,6 +288,7 @@ int encrypt_rsa_message(const char *plaintext, EVP_PKEY *public_key, unsigned ch + } + + int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedtext_len, EVP_PKEY *private_key, unsigned char **plaintext, int use_pkcs1_padding) { ++ int ret =0; + #if OPENSSL_VERSION_MAJOR >= 3 + EVP_PKEY_CTX *ctx; + #else +@@ -310,7 +311,8 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt + keysize = RSA_size(rsa); + #endif + rsa_buffer = OPENSSL_malloc(keysize * 2); +- *plaintext = (unsigned char*)OPENSSL_malloc(keysize); ++ // Note: +1 for NULL ++ *plaintext = (unsigned char*)OPENSSL_malloc(keysize + 1); + + BIO *bioBuff = BIO_new_mem_buf((void*)encryptedtext, encryptedtext_len); + rsa_buffer_len = BIO_read(bioBuff, rsa_buffer, keysize * 2); +@@ -320,13 +322,15 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt + padding = RSA_PKCS1_PADDING; + } + #if OPENSSL_VERSION_MAJOR >= 3 ++ + plaintext_len = keysize; + EVP_PKEY_decrypt_init(ctx); +- int ret = EVP_PKEY_CTX_set_rsa_padding(ctx, padding); ++ ++ ret = EVP_PKEY_CTX_set_rsa_padding(ctx, padding); + if (ret < 0){ + goto errreturn; + } +- EVP_PKEY_decrypt(ctx, *plaintext, &plaintext_len, rsa_buffer, rsa_buffer_len); ++ ret = EVP_PKEY_decrypt(ctx, *plaintext, &plaintext_len, rsa_buffer, rsa_buffer_len); + EVP_PKEY_CTX_free(ctx); + #else + plaintext_len = RSA_private_decrypt(rsa_buffer_len, rsa_buffer, *plaintext, rsa, padding); +@@ -337,7 +341,7 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt + BIO_free(bioBuff); + + /* Treat a decryption error as an empty string. */ +- if (plaintext_len < 0) { ++ if (plaintext_len <= 0) { + plaintext_len = 0; + } + +@@ -386,24 +390,28 @@ int decode_auth_setting(int enable_debug, const char *authtoken, EVP_PKEY *priva + int plaintext_len; + plaintext_len = decrypt_rsa_message(encrypted_b64, encrypted_len_b64, private_key, &plaintext, use_pkcs1_padding); + free(encrypted_b64); +- if (plaintext_len < 0) { ++ if (plaintext_len <= 0) { + return -1; + } ++ + plaintext[plaintext_len] = '\0'; + + char *s_username, *s_password; + s_username = (char *) calloc(plaintext_len, sizeof(char)); + if (s_username == NULL) { ++ OPENSSL_free(plaintext); + return -1; + } + s_password = (char *) calloc(plaintext_len, sizeof(char)); + if (s_password == NULL) { ++ OPENSSL_free(plaintext); + free(s_username); + return -1; + } + + int rc = sscanf((char *) plaintext, auth_text_format, s_username, s_password, &utc_seconds); + if (rc != 3) { ++ OPENSSL_free(plaintext); + free(s_password); + free(s_username); + return -1; +-- +2.45.4 + diff --git a/SPECS/iperf3/CVE-2025-54350.patch b/SPECS/iperf3/CVE-2025-54350.patch new file mode 100644 index 00000000000..c26afc29d2c --- /dev/null +++ b/SPECS/iperf3/CVE-2025-54350.patch @@ -0,0 +1,35 @@ +From 86bc637b483dc5de37f9a33583251bc08d32892e Mon Sep 17 00:00:00 2001 +From: "Bruce A. Mah" +Date: Tue, 24 Jun 2025 15:58:21 -0700 +Subject: [PATCH] Prevent crash due to assertion failures on malformed + authentication attempt. + +Reported by Han Lee (Apple Information Security) +CVE-2025-54350 +--- + src/iperf_auth.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/src/iperf_auth.c b/src/iperf_auth.c +index 72e85fc..b9f2bc0 100644 +--- a/src/iperf_auth.c ++++ b/src/iperf_auth.c +@@ -28,7 +28,6 @@ + #include "iperf_config.h" + + #include +-#include + #include + #include + /* FreeBSD needs _WITH_GETLINE to enable the getline() declaration */ +@@ -152,7 +151,6 @@ int Base64Decode(const char* b64message, unsigned char** buffer, size_t* length) + + BIO_set_flags(bio, BIO_FLAGS_BASE64_NO_NL); //Do not use newlines to flush buffer + *length = BIO_read(bio, *buffer, strlen(b64message)); +- assert(*length == decodeLen); //length should equal decodeLen, else something went horribly wrong + BIO_free_all(bio); + + return (0); //success +-- +2.45.4 + diff --git a/SPECS/iperf3/iperf3.spec b/SPECS/iperf3/iperf3.spec index 6b5adf200cc..3c8edabf0f4 100644 --- a/SPECS/iperf3/iperf3.spec +++ b/SPECS/iperf3/iperf3.spec @@ -1,7 +1,7 @@ Summary: A network performance benchmark tool. Name: iperf3 Version: 3.17.1 -Release: 2%{?dist} +Release: 3%{?dist} License: BSD and MIT and Public Domain Vendor: Microsoft Corporation Distribution: Azure Linux @@ -10,6 +10,8 @@ URL: https://github.com/esnet/iperf Source0: https://github.com/esnet/iperf/archive/%{version}.tar.gz#/%{name}-%{version}.tar.gz Patch1: disablepg.patch Patch2: CVE-2024-53580.patch +Patch3: CVE-2025-54350.patch +Patch4: CVE-2025-54349.patch BuildRequires: autoconf >= 2.71 BuildRequires: automake @@ -67,6 +69,9 @@ make %{?_smp_mflags} check %{_mandir}/man3/libiperf.3.gz %changelog +* Mon Aug 04 2025 Azure Linux Security Servicing Account - 3.17.1-3 +- Patch for CVE-2025-54350, CVE-2025-54349 + * Tue Dec 31 2024 Kanishk Bansal - 3.17.1-2 - Address CVE-2024-53580 using an upstream patch.