REDHAT-BUG-2556267: Medium severity Red Hat iscsi-initiator-utils (iscsiuio) vulnerability
Summary: The IPv6 Neighbor Discovery handlers in iscsiuio access the Link-Layer Address option at a fixed 24-byte offset without verifying the payload is long enough. A valid, RFC-compliant NA with no options causes a 1-byte heap OOB read. Additionally, an unconditional ARP table update with attacker-controlled source MAC/IP enables deterministic ARP table poisoning.
Component affected: iscsi-initiator-utils (iscsiuio), iscsiuio/src/uip/ipv6.c, ipv6icmphandlendadv() (line 939) and ipv6icmphandlendsol() (line 988).
Vulnerability Details:
Both ND handlers compute linkopt at a fixed 24-byte offset past the ICMPv6 header without checking payload length. Per RFC 4861, valid ND messages may have exactly 24 bytes payload (no options). With no options, linkopt points past the payload into heap.
Two issues in ipv6icmphandlendadv():
1. DETERMINISTIC ARP POISONING (line 966): ipv6updatearptable() is called unconditionally with &ipv6->ipv6src and ð->srcmac — both attacker-controlled. Any NA deterministically poisons the ARP table. No heap byte matching needed.
2. HEAP OOB READ (line 971): linkopt->hdr.type reads 1 byte from heap. If it matches IPV6ICMPOPTIONTARADDR (value 2, 1/256 probability), 6 bytes of heap data are written as a MAC address.
No upstream length validation exists. Commit c797fa7 clamps ipv6plen in uipprocess() but does NOT fix the no-option variant where ipv6plen is valid (exactly 24).
Version affected: All versions including latest upstream master (a65ce4b). Confirmed unfixed: ASAN heap-buffer-overflow READ of size 1 at ipv6.c:997.
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - 6.8 C:L — heap byte disclosure via ARP table entry I:H — deterministic ARP table poisoning with attacker-controlled addresses A:L — corrupted ARP entries disrupt connectivity
Proposed Fix: Check plen >= 32 (24-byte ND header + 8-byte option) before dereferencing linkopt.
Upstream status: No fix exists. No upstream commit touches these functions. Acknowledgement: Red Hat Product Security
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In both IPv6 Neighbor Discovery handlers, ipv6_icmp_handle_nd_adv() and ipv6_icmp_handle_nd_sol(), check that plen is at least 32 bytes (24-byte ND header plus an 8-byte option) before dereferencing link_opt.