CaROS/meta-openembedded
3
1
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-01-01 13:58:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

iperf3: Fix CVE-2025-54349

Browse Source 
This commit fix heap overflow for iperf3 package

Reference: 4e5313bab0

Signed-off-by: Nitin Wankhade <nitin.wankhade333@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Nitin Wankhade 2025-09-23 10:24:54 +05:30 committed by Khem Raj
parent e3fc979b65
commit 7b0f353128
No known key found for this signature in database
GPG Key ID: BB053355919D3314
2 changed files with 82 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
meta-oe/recipes-benchmark/iperf3/iperf3/CVE-2025-54349.patch Normal file
View File

@ -0,0 +1,80 @@
Subject: [PATCH] iperf3: Fix CVE-2025-54349
CVE: CVE-2025-54349
Upstream-Status: Backport [https://github.com/esnet/iperf/commit/4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf]
Signed-off-by: Nitin Wankhade <nitin.wankhade333@gmail.com>
---
diff --git a/iperf_auth.c b/iperf_auth.c
index 72e85fc..91c4133 100644
--- a/src/iperf_auth.c
+++ b/src/iperf_auth.c
@@ -288,6 +288,7 @@ int encrypt_rsa_message(const char *plaintext, EVP_PKEY *public_key, unsigned ch
}
int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedtext_len, EVP_PKEY *private_key, unsigned char **plaintext, int use_pkcs1_padding) {
+ int ret =0;
#if OPENSSL_VERSION_MAJOR >= 3
EVP_PKEY_CTX *ctx;
#else
@@ -310,7 +311,8 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt
keysize = RSA_size(rsa);
#endif
rsa_buffer = OPENSSL_malloc(keysize * 2);
- *plaintext = (unsigned char*)OPENSSL_malloc(keysize);
+ // Note: +1 for NULL
+ *plaintext = (unsigned char*)OPENSSL_malloc(keysize + 1);
BIO *bioBuff = BIO_new_mem_buf((void*)encryptedtext, encryptedtext_len);
rsa_buffer_len = BIO_read(bioBuff, rsa_buffer, keysize * 2);
@@ -322,11 +324,12 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt
#if OPENSSL_VERSION_MAJOR >= 3
plaintext_len = keysize;
EVP_PKEY_decrypt_init(ctx);
- int ret = EVP_PKEY_CTX_set_rsa_padding(ctx, padding);
+
+ ret = EVP_PKEY_CTX_set_rsa_padding(ctx, padding);
if (ret < 0){
goto errreturn;
}
- EVP_PKEY_decrypt(ctx, *plaintext, &plaintext_len, rsa_buffer, rsa_buffer_len);
+ ret = EVP_PKEY_decrypt(ctx, *plaintext, &plaintext_len, rsa_buffer, rsa_buffer_len);
EVP_PKEY_CTX_free(ctx);
#else
plaintext_len = RSA_private_decrypt(rsa_buffer_len, rsa_buffer, *plaintext, rsa, padding);
@@ -337,7 +340,7 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt
BIO_free(bioBuff);
/* Treat a decryption error as an empty string. */
- if (plaintext_len < 0) {
+ if (plaintext_len <= 0) {
plaintext_len = 0;
}
@@ -386,7 +389,7 @@ int decode_auth_setting(int enable_debug, const char *authtoken, EVP_PKEY *priva
int plaintext_len;
plaintext_len = decrypt_rsa_message(encrypted_b64, encrypted_len_b64, private_key, &plaintext, use_pkcs1_padding);
free(encrypted_b64);
- if (plaintext_len < 0) {
+ if (plaintext_len <= 0) {
return -1;
}
plaintext[plaintext_len] = '\0';
@@ -394,16 +397,19 @@ int decode_auth_setting(int enable_debug, const char *authtoken, EVP_PKEY *priva
char *s_username, *s_password;
s_username = (char *) calloc(plaintext_len, sizeof(char));
if (s_username == NULL) {
+ OPENSSL_free(plaintext);
return -1;
}
s_password = (char *) calloc(plaintext_len, sizeof(char));
if (s_password == NULL) {
+ OPENSSL_free(plaintext);
free(s_username);
return -1;
}
int rc = sscanf((char *) plaintext, auth_text_format, s_username, s_password, &utc_seconds);
if (rc != 3) {
+ OPENSSL_free(plaintext);
free(s_password);
free(s_username);
return -1;

3
meta-oe/recipes-benchmark/iperf3/iperf3_3.18.bb
View File

@ -16,7 +16,8 @@ SRC_URI = "git://github.com/esnet/iperf.git;branch=master;protocol=https \
file://0002-Remove-pg-from-profile_CFLAGS.patch \
file://0001-configure.ac-check-for-CPP-prog.patch \
file://0001-fix-build-with-gcc-15.patch \
"
file://CVE-2025-54349.patch \
"
SRCREV = "2a2984488d6de8f7a2d1f5938e03ca7be57e227c"