CVE-2026-115485: Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
Other sources
Summary: The DHCPv6 vendor option parser in iscsiuio calls strlen() on raw network-received data with no NUL-terminator guarantee, causing an unbounded heap read. The result is used for a 1-byte NUL OOB write and an strcpy that corrupts the iSCSI initiator name with heap-derived data.
Component affected: iscsi-initiator-utils (iscsiuio), iscsiuio/src/apps/dhcpc/dhcpv6.c, dhcpv6parsevendoroption() (line 480).
Vulnerability Details:
dhcpv6parsevendoroption() at line 495 calls: datalen = strlen((char )data)
where data points to raw network-received bytes from a DHCPv6 Vendor-Specific Information option (type 17), sub-option 203 (iSCSI initiator name). No NUL terminator is guaranteed. strlen() walks past the buffer into adjacent heap memory.
The returned length is then used for: 1. data[datalen] = '\0' at line 509 — 1-byte heap OOB write (NUL byte). datalen cap at ISCSIMAXISCSINAMELENGTH (128) limits offset but does NOT prevent strlen from reading arbitrarily far. 2. strcpy(context->initiatorName, (char )data) at line 510 — copies up to 128 bytes of heap-derived data into the iSCSI initiator name, corrupting iSCSI identity configuration.
This bug is distinct from CVE-2026-18727 (integer underflow in ipv6udphandledhcp). This is in dhcpv6parsevendoroption() — completely different function and code path.
Attack preconditions: dhcpv6state must be DHCPV6STATESOLICITSENT (timing window during DHCPv6 boot, reliably reachable every boot). Attacker controls VENDORCLASS option to match dhcpvendorid. L2-adjacent access required.
Version affected: All versions including latest upstream master (a65ce4b). Confirmed unfixed: ASAN heap-buffer-overflow READ of size 163 in strlen, called from dhcpv6parsevendoroption.
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H - 8.3 C:H — strlen walks heap arbitrarily; strcpy copies heap data into named buffer I:L — strcpy into initiatorName corrupts iSCSI identity; NUL write can corrupt heap metadata A:H — reliable crash from OOB read or heap corruption
Proposed Fix: Replace strlen() with strnlen() bounded by the option's declared length.
Upstream status: No fix exists. No upstream commit touches dhcpv6parsevendoroption(). Acknowledgement: Red Hat Product Security
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In iscsiuio/src/apps/dhcpc/dhcpv6.c, update dhcpv6_parse_vendor_option() to replace strlen((char *)data) with strnlen() bounded by the DHCPv6 vendor option's declared length.