Memory Exhaustion DoS in iperf3

Executive Summary

This vulnerability is a memory exhaustion flaw in iperf3. A remote attacker can send a specially crafted message with an excessively large length value to the JSON_read() function. The function allocates memory based on this peer-controlled value without checking for reasonable limits, causing the application to consume excessive memory. This leads to a Denial of Service (DoS) by slowing down or crashing the iperf3 service entirely.

Useful 0 Not Useful 0

Detection Guidance

Monitor iperf3 service memory usage and network traffic to the control port. Check for unusually high memory consumption or slowdowns in iperf3 processes. Use tools like netstat or ss to verify connections to the iperf3 control port (default 5201).

Commands to detect: netstat -tulnp | grep iperf3, ss -tulnp | grep iperf3, ps aux | grep iperf3, top or htop to monitor memory usage.

Useful 0 Not Useful 0

Impact Analysis

If you run iperf3 in server mode, an attacker could exploit this to disrupt your network performance testing service. The service may slow down significantly, become unresponsive, or crash entirely due to memory exhaustion. This could interrupt legitimate network testing activities and require manual intervention to restart the service.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict network access to the iperf3 control port using firewall rules to allow only trusted clients. Run iperf3 in environments with memory limits like containers or processes to contain resource exhaustion.

Apply firewall rules: iptables -A INPUT -p tcp --dport 5201 -s trusted_ip -j ACCEPT, iptables -A INPUT -p tcp --dport 5201 -j DROP. Consider upgrading to supported versions or applying vendor mitigations if available.

Useful 0 Not Useful 0