CVE-2025-54351

A flaw was found in iperf3. The recv function in net.c exhibits a buffer overflow when the --skip-rx-copy option is used with MSG_TRUNC, allowing a network attacker to trigger the overflow. This vulnerability allows an attacker to send a specially crafted message. The resulting buffer overflow may lead to an application-level denial of service.

This vulnerability was introduced with option --skip-rx-copy which was added after version 3.17.1. We currently have an older version of code in Red Hat Enterprise Linux(RHEL). No Red Hat products or offerings are affected by this vulnerability.

This vulnerability marked as Important instead a Moderate flaw due to the nature of the bug and the execution context. The flaw lies in the mishandling of buffer boundaries when the MSG_TRUNC flag is used in conjunction with the --skip-rx-copy option, leading to a classical buffer overflow. Unlike typical logic or input validation bugs that may merely crash an application, buffer overflows directly corrupt memory, potentially allowing arbitrary code execution depending on memory layout and platform-specific mitigations. Since iperf3 is often used in automated performance testing setups, CI pipelines, or even embedded environments, attackers could exploit this vulnerability remotely by sending crafted UDP packets, leading to memory corruption without any authentication. The use of MSG_TRUNC and skipped copy operations already places the application in a performance-optimized but less safe path, and the lack of proper bounds checking under these conditions makes it a memory safety issue—a class of bugs known to be exploitable and impactful

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.