CVE-2026-115486: Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
Other sources
Summary: The IPv6 Neighbor Discovery handlers in iscsiuio access the Link-Layer Address option at a fixed 24-byte offset without verifying the payload is long enough. A valid, RFC-compliant NA with no options causes a 1-byte heap OOB read. Additionally, an unconditional ARP table update with attacker-controlled source MAC/IP enables deterministic ARP table poisoning.
Component affected: iscsi-initiator-utils (iscsiuio), iscsiuio/src/uip/ipv6.c, ipv6icmphandlendadv() (line 939) and ipv6icmphandlendsol() (line 988).
Vulnerability Details:
Both ND handlers compute linkopt at a fixed 24-byte offset past the ICMPv6 header without checking payload length. Per RFC 4861, valid ND messages may have exactly 24 bytes payload (no options). With no options, linkopt points past the payload into heap.
Two issues in ipv6icmphandlendadv():
1. DETERMINISTIC ARP POISONING (line 966): ipv6updatearptable() is called unconditionally with &ipv6->ipv6src and ð->srcmac — both attacker-controlled. Any NA deterministically poisons the ARP table. No heap byte matching needed.
2. HEAP OOB READ (line 971): linkopt->hdr.type reads 1 byte from heap. If it matches IPV6ICMPOPTIONTARADDR (value 2, 1/256 probability), 6 bytes of heap data are written as a MAC address.
No upstream length validation exists. Commit c797fa7 clamps ipv6plen in uipprocess() but does NOT fix the no-option variant where ipv6plen is valid (exactly 24).
Version affected: All versions including latest upstream master (a65ce4b). Confirmed unfixed: ASAN heap-buffer-overflow READ of size 1 at ipv6.c:997.
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - 6.8 C:L — heap byte disclosure via ARP table entry I:H — deterministic ARP table poisoning with attacker-controlled addresses A:L — corrupted ARP entries disrupt connectivity
Proposed Fix: Check plen >= 32 (24-byte ND header + 8-byte option) before dereferencing linkopt.
Upstream status: No fix exists. No upstream commit touches these functions. Acknowledgement: Red Hat Product Security
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In iscsiuio's ipv6_icmp_handle_nd_adv() and ipv6_icmp_handle_nd_sol(), verify that the IPv6 payload length (plen) is at least 32 bytes (24-byte Neighbor Discovery header plus 8-byte option) before dereferencing link_opt.