Executive brief
A flaw in open-iscsi's DHCPv6 client component can be exploited by an attacker on the same local network to crash the service or disrupt operations. An attacker sends specially crafted IPv6 network traffic while a client is performing network configuration, causing the software to malfunction and become unavailable. This vulnerability only affects systems actively using DHCPv6 for IPv6 network configuration.
Technical details
The vulnerability is an integer underflow (CWE-191) in the iscsiuio component's DHCPv6 packet parsing logic. Crafted DHCPv6 Advertise messages with abnormally short UDP length fields cause the payload length calculation to underflow, triggering an out-of-bounds read. An unauthenticated attacker on an adjacent network segment (same L2 network) can exploit this by sending malicious IPv6 UDP traffic while the client is actively performing DHCPv6 configuration. Successful exploitation results in a denial of service via process crash or service disruption. No remote code execution or data breach is possible; the impact is limited to availability. Patches are expected from the vendor but fix availability is not yet specified in this advisory.
Affected products
- open-iscsi iscsi-initiator-utils
Timeline
- 2026-08-12: disclosed