CVE-2024-26306
📋 TL;DR
This vulnerability in iPerf3 allows attackers to exploit a timing side channel in RSA decryption operations when using OpenSSL with RSA authentication. Attackers could potentially recover credential plaintext by sending numerous messages for decryption. This affects iPerf3 servers using RSA authentication with vulnerable OpenSSL versions.
💻 Affected Systems
- iPerf3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers recover authentication credentials, potentially gaining unauthorized access to iPerf3 servers and the systems they run on.
Likely Case
Credential theft requiring significant attacker effort and specific conditions (RSA authentication enabled, many messages sent).
If Mitigated
Minimal impact if RSA authentication is disabled or systems are patched.
🎯 Exploit Status
Exploitation requires sending large numbers of messages and timing analysis, making it complex but feasible with sufficient resources.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.17
Vendor Advisory: https://downloads.es.net/pub/iperf/esnet-secadv-2024-0001.txt.asc
Restart Required: Yes
Instructions:
1. Download iPerf3 version 3.17 or later from GitHub releases. 2. Stop iPerf3 services. 3. Install the updated version. 4. Restart iPerf3 services.
🔧 Temporary Workarounds
Disable RSA Authentication
allConfigure iPerf3 server to use alternative authentication methods or disable authentication if not required.
Modify iPerf3 configuration to remove RSA authentication options
Update OpenSSL
linuxUpgrade OpenSSL to version 3.2.0 or later to mitigate the underlying timing side channel.
apt-get update && apt-get upgrade openssl
yum update openssl
🧯 If You Can't Patch
- Disable RSA authentication on iPerf3 servers
- Restrict network access to iPerf3 servers using firewalls or network segmentation
🔍 How to Verify
Check if Vulnerable:
Check iPerf3 version with 'iperf3 --version' and verify if RSA authentication is enabled in configuration.Check Version:
iperf3 --versionVerify Fix Applied:
Confirm iPerf3 version is 3.17 or later with 'iperf3 --version' and ensure OpenSSL is 3.2.0+ with 'openssl version'.📡 Detection & Monitoring
Log Indicators:
- Unusual volume of authentication attempts
- Multiple failed RSA decryption attempts
Network Indicators:
- High volume of traffic to iPerf3 server ports (default 5201)
- Patterns of repeated authentication requests
SIEM Query:
source="iperf3" AND (event_type="authentication" OR event_type="decryption") AND count > threshold🔗 References
- https://downloads.es.net/pub/iperf/esnet-secadv-2024-0001.txt.asc
- https://github.com/esnet/iperf/releases/tag/3.17
- https://www.insyde.com/security-pledge/SA-2024005
- https://downloads.es.net/pub/iperf/esnet-secadv-2024-0001.txt.asc
- https://github.com/esnet/iperf/releases/tag/3.17
- https://lists.debian.org/debian-lts-announce/2025/01/msg00027.html
- https://security.netapp.com/advisory/ntap-20250228-0007/
