[Buildroot] [2025.02.x, PATCH 1/2] package/iperf3: add patch to fix CVE-2025-54349

[Arnout Vandecappelle]

On 05/09/2025 09:48, Thomas Perale via buildroot wrote:
> Fixes the following vulnerability:
> 
> - CVE-2025-54349
> 
>      In iperf before 3.19.1, iperf_auth.c has an off-by-one error and
>      resultant heap-based buffer overflow.
> 
> For more information, see:
>    - https://www.cve.org/CVERecord?id=CVE-2025-54349
>    - https://github.com/esnet/iperf/commit/4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf
> 
> Signed-off-by: Thomas Perale <thomas.perale at mind.be>

  Applied both to 2025.02.x, thanks.

  Regards,
  Arnout

> ---
>   ...Fix-off-by-one-head-overflow-in-auth.patch | 93 +++++++++++++++++++
>   package/iperf3/iperf3.mk                      |  3 +
>   2 files changed, 96 insertions(+)
>   create mode 100644 package/iperf3/0001-Fix-off-by-one-head-overflow-in-auth.patch
> 
> diff --git a/package/iperf3/0001-Fix-off-by-one-head-overflow-in-auth.patch b/package/iperf3/0001-Fix-off-by-one-head-overflow-in-auth.patch
> new file mode 100644
> index 0000000000..38fe1327ce
> --- /dev/null
> +++ b/package/iperf3/0001-Fix-off-by-one-head-overflow-in-auth.patch
> @@ -0,0 +1,93 @@
> +From 4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf Mon Sep 17 00:00:00 2001
> +From: Sarah Larsen <swlarsen at es.net>
> +Date: Wed, 25 Jun 2025 15:11:03 +0000
> +Subject: [PATCH] Fix off-by-one heap overflow in auth.
> +
> +Reported by Han Lee (Apple Information Security)
> +
> +CVE: CVE-2025-54349
> +Upstream: https://github.com/esnet/iperf/commit/4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf
> +Signed-off-by: Thomas Perale <thomas.perale at mind.be>
> +---
> + src/iperf_auth.c | 18 +++++++++++++-----
> + 1 file changed, 13 insertions(+), 5 deletions(-)
> +
> +diff --git a/src/iperf_auth.c b/src/iperf_auth.c
> +index b9f2bc0f2..632f03d24 100644
> +--- a/src/iperf_auth.c
> ++++ b/src/iperf_auth.c
> +@@ -288,6 +288,7 @@ int encrypt_rsa_message(const char *plaintext, EVP_PKEY *public_key, unsigned ch
> + }
> +
> + int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedtext_len, EVP_PKEY *private_key, unsigned char **plaintext, int use_pkcs1_padding) {
> ++    int ret =0;
> + #if OPENSSL_VERSION_MAJOR >= 3
> +     EVP_PKEY_CTX *ctx;
> + #else
> +@@ -310,7 +311,8 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt
> +     keysize = RSA_size(rsa);
> + #endif
> +     rsa_buffer  = OPENSSL_malloc(keysize * 2);
> +-    *plaintext = (unsigned char*)OPENSSL_malloc(keysize);
> ++    // Note: +1 for NULL
> ++    *plaintext = (unsigned char*)OPENSSL_malloc(keysize + 1);
> +
> +     BIO *bioBuff   = BIO_new_mem_buf((void*)encryptedtext, encryptedtext_len);
> +     rsa_buffer_len = BIO_read(bioBuff, rsa_buffer, keysize * 2);
> +@@ -320,13 +322,15 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt
> +         padding = RSA_PKCS1_PADDING;
> +     }
> + #if OPENSSL_VERSION_MAJOR >= 3
> ++
> +     plaintext_len = keysize;
> +     EVP_PKEY_decrypt_init(ctx);
> +-    int ret = EVP_PKEY_CTX_set_rsa_padding(ctx, padding);
> ++
> ++    ret = EVP_PKEY_CTX_set_rsa_padding(ctx, padding);
> +     if (ret < 0){
> +         goto errreturn;
> +     }
> +-    EVP_PKEY_decrypt(ctx, *plaintext, &plaintext_len, rsa_buffer, rsa_buffer_len);
> ++    ret = EVP_PKEY_decrypt(ctx, *plaintext, &plaintext_len, rsa_buffer, rsa_buffer_len);
> +     EVP_PKEY_CTX_free(ctx);
> + #else
> +     plaintext_len = RSA_private_decrypt(rsa_buffer_len, rsa_buffer, *plaintext, rsa, padding);
> +@@ -337,7 +341,7 @@ int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedt
> +     BIO_free(bioBuff);
> +
> +     /* Treat a decryption error as an empty string. */
> +-    if (plaintext_len < 0) {
> ++    if (plaintext_len <= 0) {
> +         plaintext_len = 0;
> +     }
> +
> +@@ -386,24 +390,28 @@ int decode_auth_setting(int enable_debug, const char *authtoken, EVP_PKEY *priva
> +     int plaintext_len;
> +     plaintext_len = decrypt_rsa_message(encrypted_b64, encrypted_len_b64, private_key, &plaintext, use_pkcs1_padding);
> +     free(encrypted_b64);
> +-    if (plaintext_len < 0) {
> ++    if (plaintext_len <= 0) {
> +         return -1;
> +     }
> ++
> +     plaintext[plaintext_len] = '\0';
> +
> +     char *s_username, *s_password;
> +     s_username = (char *) calloc(plaintext_len, sizeof(char));
> +     if (s_username == NULL) {
> ++        OPENSSL_free(plaintext);
> + 	return -1;
> +     }
> +     s_password = (char *) calloc(plaintext_len, sizeof(char));
> +     if (s_password == NULL) {
> ++        OPENSSL_free(plaintext);
> + 	free(s_username);
> + 	return -1;
> +     }
> +
> +     int rc = sscanf((char *) plaintext, auth_text_format, s_username, s_password, &utc_seconds);
> +     if (rc != 3) {
> ++        OPENSSL_free(plaintext);
> + 	free(s_password);
> + 	free(s_username);
> + 	return -1;
> diff --git a/package/iperf3/iperf3.mk b/package/iperf3/iperf3.mk
> index 744ee070a4..c5efb1d784 100644
> --- a/package/iperf3/iperf3.mk
> +++ b/package/iperf3/iperf3.mk
> @@ -11,6 +11,9 @@ IPERF3_LICENSE = BSD-3-Clause, BSD-2-Clause, MIT
>   IPERF3_LICENSE_FILES = LICENSE
>   IPERF3_CPE_ID_VENDOR = es
>   
> +# 0001-Fix-off-by-one-head-overflow-in-auth.patch
> +IPERF3_IGNORE_CVES += CVE-2025-54349
> +
>   IPERF3_CONF_ENV += CFLAGS="$(TARGET_CFLAGS) -D_GNU_SOURCE"
>   
>   ifeq ($(BR2_PACKAGE_OPENSSL),y)