A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.

Summary: The DHCPv4 option parser in iscsiuio passes the total UDP payload length to parseoptions() instead of the options-only length, causing the parser to walk 240 bytes past the actual end of options data into adjacent heap memory.

Component affected: iscsi-initiator-utils (iscsiuio), iscsiuio/src/apps/dhcpc/dhcpc.c, parsemsg() (line 241) and parseoptions() (line 206).

Vulnerability Details:

parsemsg() at line 249 calls: parseoptions(s, &m->options[4], uipdatalen(s->ustack))

uipdatalen() returns the total UDP payload length, but &m->options[4] points 240 bytes into the DHCP message (236-byte struct dhcpmsg header + 4-byte magic cookie). The end pointer in parseoptions() (line 208: end = optptr + len) is therefore 240 bytes past the actual end of the options data.

Additionally, parseoptions() reads optptr[1] (option length byte) without verifying 2 bytes remain before end, and all memcpy calls use hardcoded 4-byte sizes without checking the option's declared length field.

This is distinct from CVE-2026-18728, which fixes an integer underflow in uipprocess() where uiplen wraps when IPv4 Total Length < 28. This bug is in parsemsg() itself — even with a correctly computed uiplen, the offset subtraction is missing.

Requirements to exploit: Adjacent-network access on the same L2 segment as a system running iscsiuio with IPv4 DHCP enabled. The attacker must spoof a DHCP reply matching the xid and chaddr from a prior DHCP discover (both observable on L2). No authentication or user interaction required.

Version affected: All versions including latest upstream master (a65ce4b). Confirmed unfixed via ASAN-instrumented build on RHEL 10.2 (iscsi-initiator-utils-6.2.1.11-1.git4b3e853.el102.2) and upstream master.

Dynamic confirmation: ASAN SEGV in handledhcp → memcpy with OOB-derived pointer. Reproducible unit test provided.

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - 7.4 AV:A — L2-adjacent access required AC:L — standard DHCP spoofing PR:N / UI:N — no privileges or user interaction S:U — impact within iscsiuio's own security authority C:L — heap data leaks into network configuration I:L — attacker-influenced network config via heap data A:H — OOB read → SEGV crash confirmed; iSCSI-boot system loses connectivity

Proposed Fix: Subtract the DHCP message header size from the length passed to parseoptions: return parseoptions(s, &m->options[4], uipdatalen(s->ustack) - DHCPMSGLEN - 4);

Upstream status: No fix exists. CVE-2026-18728 does NOT cover this bug. Acknowledgement: Red Hat Product Security