CVE-2026-18727: Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing

AIONLYREPORT package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10 ------ Summary: Integer Underflow and Out-of-Bounds Read in DHCPv6 Packet Parsing: crafted DHCPv6 Advertise traffic with a short UDP length can underflow the DHCPv6 payload length, drive option parsing past packet bounds, and likely cause a denial of service in the iscsiuio DHCPv6 client path. Requirements to exploit: The attacker needs adjacent network access on the same L2 segment as a system running iscsiuio with DHCPv6 enabled, plus the ability to send forged IPv6 UDP traffic from source port 547 to destination port 546 while the client is in an active DHCPv6 exchange. A matching transaction ID is also required; the reviewed material indicates this can be obtained by sniffing a Solicit or by brute-forcing the 16-bit value checked by the implementation. Component affected: iscsi-initiator-utils (iscsiuio DHCPv6 receive path), specifically iscsiuio/src/uip/ipv6.c in ipv6udprx() and iscsiuio/src/apps/dhcpc/dhcpv6.c in ipv6udphandledhcp() / dhcpv6handleadvertise(). Version affected: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10 when DHCPv6 handling in iscsiuio is enabled and reachable. Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - 6.5 (MEDIUM) AV:A - The attacker must be on an adjacent network segment able to inject DHCPv6 traffic to the victim. AC:L - Packet construction is straightforward once the DHCPv6 transaction value is known or guessed, and no special conditions beyond an active DHCPv6 exchange are established. PR:N - No authentication or existing privileges are required. UI:N - No user interaction is needed. S:U - The impact is confined to the vulnerable iscsiuio component and does not cross a security boundary. C:N - The available evidence shows out-of-bounds reads, but does not establish a confidentiality disclosure. I:N - The available evidence does not show data modification or code execution. A:H - The likely outcome is process crash or comparable service disruption in the DHCPv6 path. Impact: Moderate. The currently supported impact is an adjacent-network denial of service in the DHCPv6 receive path. Although the attacker is unauthenticated, exploitability is narrower than a typical remote DoS because DHCPv6 must be enabled, the client must be in the relevant exchange state, and the packet must satisfy the transaction check. The available evidence does not establish confidentiality, integrity, or full system compromise, so Moderate better fits Red Hat's severity guidance than Important. Embargo: no Reason: The supported impact is a constrained adjacent-network availability issue with practical mitigations, not an easily exploitable remote compromise or wormable condition. Acknowledgement: Aisle Research Vulnerability Details: The DHCPv6 receive path dispatches packets to the DHCPv6 parser based on UDP ports without first rejecting undersized or inconsistent UDP length values. It then derives dhcpv6len using unsigned arithmetic and uses the result as the bound for DHCPv6 Advertise option parsing: c if ((udp->srcport == HOSTTONET16(DHCPV6SERVERPORT)) && (udp->destport == HOSTTONET16(DHCPV6CLIENTPORT))) { ... ipv6udphandledhcp(dhcpv6c); } ... dhcpv6len = NETTOHOST16(context->udp->length) - sizeof(struct udphdr); ... while (i < (dhcpv6len - sizeof(union dhcpv6hdr))) { ... } If udp->length is smaller than sizeof(struct udphdr) (8), the subtraction underflows in u16t and produces a large wrapped value. The Advertise parser then uses that wrapped value as the loop bound while walking DHCPv6 options, leading to reads beyond the actual packet data. The available report also indicates that no earlier receive-path check enforces UDP length consistency before ipv6udphandledhcp() is reached. Based on the available evidence, the practical consequence is likely process crash or similar denial of service; the current record does not establish arbitrary code execution or a proven confidentiality impact. Steps to reproduce: 1. Configure a target with IPv6 DHCP mode enabled (IPV6CONFIGDHCP) on a shared L2 segment. 2. Wait until the client is in the DHCPv6 solicit phase (DHCPV6STATESOLICITSENT). 3. Capture one outbound DHCPv6 Solicit to obtain the current transaction ID, or brute-force the 16-bit value checked by the implementation. 4. Send a forged IPv6 UDP packet to the victim with source port 547, destination port 546, DHCPv6 message type ADVERTISE, a matching transaction ID, and a UDP header length smaller than 8 such as 4. 5. Observe out-of-bounds reads during the Advertise option parsing loop; based on the available evidence this is plausibly crash-inducing and can produce a denial of service. Mitigation: If DHCPv6 is not required, disable DHCPv6 handling in iscsiuio. Where DHCPv6 is required, restrict exposure to trusted adjacent networks and prevent forged DHCPv6 server traffic from reaching clients on shared L2 segments until a fixed package is available. Proposed Fix: Reject DHCPv6 packets whose IPv6 and UDP length fields are too short or inconsistent before dispatching them to the DHCPv6 parser, and refuse to subtract the UDP header size unless the UDP length is large enough to contain it. diff diff --git a/iscsiuio/src/uip/ipv6.c b/iscsiuio/src/uip/ipv6.c @@ -1220,6 +1220,8 @@ static void ipv6udprx(struct ipv6context context) struct udphdr udp = (struct udphdr )((u8t )ipv6 + sizeof(struct ipv6hdr)); struct dhcpv6context dhcpv6c; + u16t ipv6plen = NETTOHOST16(ipv6->ipv6plen); + u16t udplen = NETTOHOST16(udp->length); @@ -1230,6 +1232,14 @@ static void ipv6udprx(struct ipv6context context) if (!(context->flags & IPV6FLAGSDISABLEDHCPV6)) { if ((udp->srcport == HOSTTONET16(DHCPV6SERVERPORT)) && (udp->destport == HOSTTONET16(DHCPV6CLIENTPORT))) { + / Require minimal UDP + DHCPv6 fixed header and consistency / + if (ipv6plen < sizeof(struct udphdr) + sizeof(union dhcpv6hdr)) + return; + if (udplen < sizeof(struct udphdr) + sizeof(union dhcpv6hdr)) + return; + if (udplen > ipv6plen) + return; + dhcpv6c = context->dhcpv6context; dhcpv6c->eth = eth; dhcpv6c->ipv6 = ipv6; diff --git a/iscsiuio/src/apps/dhcpc/dhcpv6.c b/iscsiuio/src/apps/dhcpc/dhcpv6.c @@ -258,6 +258,7 @@ void ipv6udphandledhcp(struct dhcpv6context context) union dhcpv6hdr dhcpv6; u16t dhcpv6len; + u16t udplen = NETTOHOST16(context->udp->length); if (context->dhcpv6done == TRUE) return; @@ -273,8 +274,12 @@ void ipv6udphandledhcp(struct dhcpv6context context) return; } - dhcpv6len = NETTOHOST16(context>udp->length) - sizeof(struct udphdr); + if (udplen < sizeof(struct udphdr)) + return; + dhcpv6len = udplen - sizeof(struct udphdr); + + if (dhcpv6len < sizeof(union dhcpv6hdr)) + return; ------ This report was generated using AI technology. Always review AI-generated content prior to use

— Red Hat