Description

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T22:17:14.557Z",
  "pubdate": "2026-08-12T22:17:14.557Z",
  "executiveSummary": "A denial of service vulnerability has been identified in open-iscsi affecting the iscsiuio daemon. This vulnerability allows a remote attacker positioned on the same local network segment to cause sustained, high CPU utilization and render the daemon completely unresponsive, thereby impacting overall system availability.\nThe vulnerability is triggered by parsing malformed network control traffic, specifically through the processing of Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement packets. An unauthorized attacker requires local network segment access to transmit the crafted payload. A secondary risk involving out-of-bounds reads is also present when handling short IPv6 payloads, although no memory corruption or unauthorized data exposure has been definitively confirmed.\nThe primary operational impact is the degradation or total loss of iSCSI subsystem responsiveness due to resource exhaustion caused by an infinite loop within the affected daemon.",
  "technicalDetails": "The vulnerability resides within the iscsiuio daemon of open-iscsi, specifically in the component responsible for parsing incoming Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement messages.\nThe root cause of the denial of service condition stems from improper input validation when processing ICMPv6 options. Specifically, when an attacker transmits a specially crafted ICMPv6 Router Advertisement containing a zero-length option, the parsing logic fails to handle the boundary condition correctly, causing the execution flow to enter an infinite loop.\nExploitation requires the attacker to be positioned on the same local network segment as the target system to transmit the malicious ICMPv6 packets directly to the host running the iscsiuio daemon. No authentication or elevated privileges are required for the attacker on the local network segment, as the daemon processes incoming network control messages automatically.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious ICMPv6 Router Advertisement packet embedding a zero-length option and optionally a short IPv6 payload. Second, the attacker transmits this packet onto the local network segment targeting the vulnerable host. Third, the iscsiuio daemon captures and attempts to parse the crafted ICMPv6 packet. Fourth, upon encountering the zero-length option, the daemon enters an infinite loop during packet processing, resulting in sustained maximum CPU usage on the affected core or system. Finally, this resource exhaustion renders the iscsiuio daemon unresponsive, disrupting iSCSI operations and impacting system availability.\nIn addition to the infinite loop leading to denial of service, a secondary risk of out-of-bounds reads exists when the daemon processes short IPv6 payloads. While current analysis indicates no memory corruption or sensitive data exposure resulting from these out-of-bounds reads, they further highlight the lack of robust bounds checking within the packet processing routines."
}