Where
-Infinity
0
Severity
7
Path Traversal

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record.

This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

First published (updated )
Severity
8.7
Double Free
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS.

This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.

1 / 3
Source: Red Hat
First published (updated )
Severity
8.5
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket.

This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

1 / 3
Source: Red Hat
First published (updated )
Severity
6.9
Path Traversal
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record.

This issue affects open-iscsi: from through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

1 / 3
Source: Red Hat
First published (updated )
Severity
6.5
Integer Underflow
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in open-iscsi. An integer underflow vulnerability in the iscsiuio component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the iscsiuio process crashing. This issue affects systems where iscsiuio is actively handling IPv4 DHCP traffic.

1 / 2
Source: MITRE
First published (updated )
Severity
6.5
Integer Underflow
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.

1 / 2
Source: MITRE
First published (updated )
Severity
6.5
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.

1 / 3
Source: MITRE
First published (updated )
Severity
1

A local non-root user with access to the D-Bus system bus can call the CheckConfig method implemented in the tcmu-runner daemon via handlerqcow.so and exploit an information leak by passing in arbitrary filenames to check.

This allows a local user to check for the existence of root owned files, which might enable more serious security issues in combination with other security flaws in a system.

Upstream patch:

https://github.com/open-iscsi/tcmu-runner/commit/8cf8208775022301adaa59c240bb7f93742d1329

References:

http://seclists.org/oss-sec/2017/q3/207

First published (updated )
Severity
4
Null Pointer Dereference

A local non-root user with access to the D-Bus system bus can call the UnregisterHandler method implemented in the tcmu-runner daemon with the name of a handler loaded internally in tcmu-runner via dlopen() and cause a NULL pointer dereference resulting in DoS.

Upstream patch:

https://github.com/open-iscsi/tcmu-runner/commit/bb80e9c7a798f035768260ebdadffb6eb0786178

References:

http://seclists.org/oss-sec/2017/q3/207

First published (updated )
Severity
4

A local non-root user with access to the D-Bus system bus can call the UnregisterHandler method implemented in the tcmu-runner daemon with the name of an unknown tcmu runner handler as parameter and cause a NULL pointer dereference.

Upstream patch:

https://github.com/open-iscsi/tcmu-runner/commit/e2d953050766ac538615a811c64b34358614edce

References:

http://seclists.org/oss-sec/2017/q3/207

First published (updated )
Severity
4

A local non-root user with access to the D-Bus system bus can call the CheckConfig method implemented in the tcmu-runner daemon via handlerglfs.so and cause various kinds of segmentation faults, depending on the string passed to the method.

For example the "hosts" variable in glfscheckconfig() is not zero initialized, but always freed on error, causing invalid free and/or invalid memory accesses.

Upstream patch:

https://github.com/open-iscsi/tcmu-runner/commit/61bd03e600d2abf309173e9186f4d465bb1b7157

References:

http://seclists.org/oss-sec/2017/q3/207

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203