CVE-2026-18726: Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing

AIONLYREPORT package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10 ------ Summary: Infinite Loop in ICMPv6 Router Advertisement Parsing: a crafted on-link ICMPv6 Router Advertisement with a zero-length option can hang iscsiuio in a non-terminating parse loop, and a short IPv6 payload can also underflow the option length and drive out-of-bounds reads. Requirements to exploit: An attacker must be able to send ICMPv6 Router Advertisements from the same L2 segment to an IPv6-enabled interface handled by iscsiuio. In the observed code, repeated exploitation may depend on the current IPv6 context because the handler returns early once IPV6FLAGSROUTERADVRECEIVED is set. Component affected: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10, iscsiuio/src/uip/ipv6.c, ipv6icmphandlerouteradv() Version affected: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10 where iscsiuio processes ICMPv6 Router Advertisements on an IPv6-enabled interface Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - 6.5 (MEDIUM) AV:A - The attack requires delivery of a crafted Router Advertisement from the same L2 or adjacent network. AC:L - A malformed RA with a zero-length option or a short payload is sufficient; no race or special timing was established. PR:N - No authentication or prior access to the target host is required. UI:N - No user interaction is needed once the packet reaches the daemon. S:U - The impact is limited to the iscsiuio process handling the packet. C:N - The available evidence does not establish unauthorized disclosure of protected data. I:N - The available evidence does not establish data modification or code execution. A:H - The parser can enter a non-terminating loop and render the daemon unresponsive with sustained CPU use. Impact: Moderate. The confirmed outcome is denial of service against iscsiuio, not system compromise or arbitrary code execution. While the attack is straightforward once reachable, reachability is constrained by adjacent-network access and an IPv6-enabled deployment that processes Router Advertisements, so Red Hat's Moderate classification is a better fit than Important for the evidence currently available. Embargo: no Reason: This is a configuration-dependent adjacent-network denial of service with practical operational mitigations, and the available evidence does not support code execution, privilege escalation, or data exposure. Acknowledgement: Aisle Research Vulnerability Details: ipv6icmphandlerouteradv() derives the Router Advertisement option area length from the IPv6 payload length and then advances through options by adding icmpopt->len 8 to the current offset. The parser does not reject a zero-length option and does not verify that the payload length is at least the size of struct icmpv6routeradvert before subtracting it. c optlen = HOSTTONET16(ipv6->ipv6plen) - sizeof(struct icmpv6routeradvert); len = 0; while (len < optlen) { icmpopt = (struct icmpv6opthdr )((u8t )icmp + sizeof(struct icmpv6routeradvert) + len); ... len += icmpopt->len 8; } If icmpopt->len is 0, len never increases and the loop does not terminate, causing a sustained CPU-consuming hang in iscsiuio. Separately, if ipv6->ipv6plen is smaller than sizeof(struct icmpv6routeradvert) (16), the unsigned subtraction underflows and produces an oversized optlen, which can drive reads past the valid option data. This corresponds to a non-progress loop (CWE-835) and an unsigned length underflow with out-of-bounds read risk (CWE-191 / CWE-125). The available material supports the read overrun as a secondary risk, but does not establish memory corruption or confidentiality/integrity impact. The parser is reached through uip.c -> UIPNDPCALL -> ipv6rxpacket() -> ipv6icmprx() -> ipv6icmphandlerouteradv(). No RA-specific minimum-length, zero-length-option, or per-option bounds checks were identified before this loop. Steps to reproduce: 1. Run iscsiuio on an IPv6-enabled interface where it processes ICMPv6 Router Advertisements. 2. From an adjacent host on the same L2 segment, send an ICMPv6 Router Advertisement with type=134 and an option header whose len field is 0. 3. Observe that the parser does not return, CPU utilization stays elevated, and IPv6/NDP progress through iscsiuio stalls. 4. Optional variant: send an RA with ipv6plen < 16 to underflow optlen and drive invalid option walking before the hang or fault behavior. 5. Confirm loss of forward progress via process behavior, logs, or lack of further protocol activity. Mitigation: Until a fix is available, limit or filter ICMPv6 Router Advertisements from untrusted hosts on any L2 segment that reaches interfaces handled by iscsiuio. Where operationally acceptable, avoid exposing affected iscsiuio interfaces to untrusted adjacent IPv6 traffic or disable RA-driven IPv6 configuration on those interfaces. Proposed Fix: Add explicit minimum-length, zero-length-option, and per-option bounds checks before advancing through the Router Advertisement option list. diff diff --git a/iscsiuio/src/uip/ipv6.c b/iscsiuio/src/uip/ipv6.c @@ -850,6 +850,7 @@ static void ipv6icmphandlerouteradv(struct ipv6context context) struct icmpv6routeradvert icmp = (struct icmpv6routeradvert )((u8t )ipv6 + sizeof(struct ipv6hdr)); struct icmpv6opthdr icmpopt; + u16t payloadlen; u16t optlen; u16t len; char addrstr[INET6ADDRSTRLEN]; @@ -857,8 +858,13 @@ static void ipv6icmphandlerouteradv(struct ipv6context context) if (context->flags & IPV6FLAGSROUTERADVRECEIVED) return; optlen = HOSTTONET16(ipv6>ipv6plen) - - sizeof(struct icmpv6routeradvert); + payloadlen = HOSTTONET16(ipv6->ipv6plen); + if (payloadlen < sizeof(struct icmpv6routeradvert)) + return; + + optlen = payloadlen - sizeof(struct icmpv6routeradvert); icmpopt = (struct icmpv6opthdr )((u8t )icmp + sizeof(struct icmpv6routeradvert)); len = 0; - while (len < optlen) { + while (len + sizeof(struct icmpv6opthdr) <= optlen) { + u16t step; icmpopt = (struct icmpv6opthdr )((u8t )icmp + sizeof(struct icmpv6routeradvert) + len); + if (icmpopt->len == 0) + break; + step = (u16t)icmpopt->len 8; + if (len + step > optlen) + break; @@ -879,7 +885,7 @@ static void ipv6icmphandlerouteradv(struct ipv6context context) break; } len += icmpopt>len 8; + len += step; } ------ This report was generated using AI technology. Always review AI-generated content prior to use

— Red Hat

Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing

— Microsoft