Description

A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-12T22:17:14.697Z",
  "pubdate": "2026-08-12T22:17:14.697Z",
  "executiveSummary": "An integer underflow and out-of-bounds read vulnerability has been identified within the open-iscsi package, specifically localized to the iscsiuio component during the parsing of Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packets.\nThe flaw allows an unauthenticated, adjacent network attacker to cause a denial of service, resulting in a process crash or service disruption on the targeted system.\nThe vulnerability is triggered when the affected component processes crafted DHCPv6 Advertise traffic containing a truncated User Datagram Protocol (UDP) length.\nThis malformed input forces the DHCPv6 payload length calculation to underflow, subsequently leading to out-of-bounds memory read operations during packet inspection.\nExploitation requires the attacker to be positioned on the same adjacent network segment as the target, transmitting the crafted IPv6 UDP traffic precisely while the client is engaged in an active DHCPv6 exchange.\nSuccessful exploitation compromises the availability of the iSNS/iscsiuio subsystem, creating potential disruptions for dependent storage connectivity without requiring any prior authentication or elevated privileges.",
  "technicalDetails": "The root cause of the vulnerability resides in the iscsiuio component of open-iscsi during the handling and parsing routines for DHCPv6 packets.\nSpecifically, the flaw stems from a failure to properly validate the User Datagram Protocol (UDP) length header fields relative to expected DHCPv6 protocol data structures.\nWhen a client is actively participating in a DHCPv6 network exchange, an unauthenticated attacker situated on the adjacent network segment can inject maliciously crafted DHCPv6 Advertise traffic containing an artificially shortened UDP length field.\nDuring packet processing, the component subtracts header lengths or parses the advertised payload size using unchecked arithmetic operations, causing the calculated DHCPv6 payload length value to wrap around and result in an integer underflow.\nFollowing the integer underflow, the parsing logic misinterprets the resulting large or negative value as a valid size indicator, leading to out-of-bounds read operations as the application attempts to read memory beyond the allocated packet buffer boundaries.\nThis invalid memory access attempts to read restricted or unmapped memory regions, triggering a segmentation fault or memory corruption exception that forcefully crashes the iscsiuio daemon process.\nThe attack flow requires precise timing, as the malicious IPv6 UDP packets must reach the client while it is actively listening during an ongoing DHCPv6 exchange.\nBecause the vulnerability causes an immediate application termination and service crash, the post-exploitation impact is strictly limited to a denial of service against the iscsiuio service, impeding network booting or interface configuration dependent upon the daemon.\nNo authentication or privilege levels are required by the threat actor beyond local network adjacency capable of transmitting forged IPv6 link-local or routable multicast/unicast frames to the victim client."
}