CVE-2024-26306: es iperf3 Covert Timing Channel

Vulnerability summary

CVE-2024-26306 is a medium (CVSS 5.9) Covert Timing Channel vulnerability in es iperf3. EPSS estimates a 1.10% chance of exploitation in the next 30 days, higher than 65.1% of scored vulnerabilities.

Timeline

1. 13-05-2024
   PublishedVulnerability first disclosed.
2. 03-11-2025
   Last modifiedVulnerability information updated.

Description

iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

• CWE-385Covert Timing ChannelCovert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.