Description

A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T04:17:19.340Z",
  "pubdate": "2026-08-13T04:17:19.340Z",
  "executiveSummary": "An integer underflow vulnerability exists in the open-iscsi software package, specifically within the iscsiuio component during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing. This security flaw enables a remote attacker positioned on the identical local network segment to induce a denial of service condition against target systems. By transmitting a specially crafted IPv4/UDP DHCP reply message, an unauthorized adjacent attacker can trigger an out-of-bounds read memory access violation. This memory corruption forces the iscsiuio process to terminate unexpectedly, crashing the network interface management daemon. The vulnerability specifically impacts enterprise systems and hypervisors where the affected iscsiuio service is actively engaged in handling and processing IPv4 DHCP network traffic. Successful exploitation requires network proximity on the local broadcast or subnet domain, as DHCP traffic operates at the local link layer. The primary risk implication is service disruption of iSCSI storage connectivity, potentially leading to cascading application failures or kernel panics depending on storage timeout configurations and multipath setup robustness.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient bounds checking and arithmetic validation during the processing of IPv4 DHCP reply packets within the iscsiuio component of open-iscsi. When the iscsiuio daemon parses incoming IPv4/UDP DHCP configuration payloads, an integer underflow condition occurs if fields within the malicious packet specify length parameters that do not align with expected protocol constraints or buffer boundaries. This arithmetic miscalculation yields an invalid, excessively large unsigned integer representation of remaining data lengths. When this corrupted value is subsequently utilized in pointer arithmetic or buffer slicing operations, it directs memory read operations outside the allocated boundaries of the internal packet reception buffer. This out-of-bounds read triggers an immediate segmentation fault or bus error, causing the operating system kernel to forcefully terminate the iscsiuio process.\nThe attack flow proceeds as follows: First, an attacker establishes presence on the local network segment shared by the target system running the vulnerable iscsiuio daemon. Second, the attacker listens for or provokes DHCP transactions initiated by the target system. Third, the attacker crafts a malicious IPv4/UDP DHCP reply packet containing manipulated option fields designed to induce the integer underflow condition during parsing. Fourth, the attacker transmits this crafted payload onto the local network segment addressed to the target interface. Fifth, upon receipt, the iscsiuio component attempts to parse the DHCP reply, encounters the arithmetic underflow, executes an out-of-bounds read, and immediately crashes. Authentication is not required, as standard DHCP operations occur prior to network authentication phases. Privilege requirements are minimal for the attacker, who merely requires layer-2 or layer-3 network adjacency to inject the malicious UDP datagram. Network exposure is strictly limited to the local network segment due to the broadcast and non-routable nature of standard DHCP traffic. Post-exploitation impact is constrained to denial of service, specifically the disruption of iSCSI network interface management functionality and potential loss of block storage access."
}