{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Keith Linneman (Linneman Labs) for reporting this issue.", "bugzilla": {"description": "open-iscsi: open-iscsi: Out-of-bounds access in iscsiuio ICMPv6 echo handling", "id": "2462023", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462023"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-787", "details": ["AI_ONLY_REPORT\npackage: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10\n------\nSummary: Out-of-Bounds Write and Information Disclosure via Unvalidated \nIPv6 Payload Length: crafted ICMPv6 Echo Requests can cause `iscsiuio` to \ntrust an inflated `ipv6_plen` larger than the actual received payload, \nleading to MTU-bounded out-of-bounds reads and a potential one-byte \nout-of-bounds write that may disclose data beyond the valid packet boundary.\nRequirements to exploit: Adjacent-network access on the same L2 segment as \na system running `iscsiuio` on an interface that processes IPv6/NDP \ntraffic, plus the ability to send a crafted ICMPv6 Echo Request with a \nforged `IPv6.plen`. No authentication or user interaction is required.\nComponent affected: `iscsi-initiator-utils` (`iscsiuio`): \n`iscsiuio/src/uip/ipv6.c` in `ipv6_icmp_handle_echo_request()` and \n`ipv6_insert_protocol_chksum()`.\nVersion affected: `iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10` when \n`iscsiuio` is processing IPv6/NDP traffic on a reachable interface.\nPatch available: no released package fix established; proposed patch \nincluded below\nVersion fixed: unknown\nUpstream coordination: Not notified.\nCVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - 6.3 (MEDIUM)\nAV:A - Reachability is limited to an attacker on the same L2 segment who \ncan send crafted IPv6/ICMPv6 traffic to the affected interface.\nAC:L - The attack relies on forging `IPv6.plen`; no race or unusual \nenvironment is needed beyond the vulnerable deployment.\nPR:N - No privileges are required.\nUI:N - No user interaction is required.\nS:U - The impact remains within the `iscsiuio` process and its packet \nbuffer handling.\nC:L - The reply/checksum path can read and potentially transmit data \nbeyond the valid packet boundary, but the demonstrated exposure is \nMTU-bounded.\nI:L - For odd forged lengths, the checksum path can write a single \npadding byte past the valid protocol data, which may affect adjacent buffer \ncontents.\nA:L - Invalid memory access may destabilize or crash the process, but \nreliable high-impact denial of service is not established from the \navailable evidence.\nImpact: Moderate. Under Red Hat's severity guidance, this is more \nconsistent with a flaw that can affect confidentiality, integrity, or \navailability under constrained circumstances than with an Important issue. \nThe bug is unauthenticated and adjacent-network reachable, but the \ncurrently supported outcome is MTU-bounded out-of-bounds access in a \ndeployment-dependent IPv6/NDP path, not easy remote system compromise or \nclearly high-impact memory corruption.\nEmbargo: no\nReason: The currently supported impact is Moderate, exposure depends on \n`iscsiuio` processing IPv6 traffic on a reachable L2 segment, and operators \ncan reduce exposure operationally by isolating or disabling the affected \npath.\nAcknowledgement: Aisle Research\nVulnerability Details: In the ICMPv6 echo-reply path, the code reuses the \ninbound `ipv6_plen` field when sizing the reply instead of clamping it to \nthe bytes actually received:\n```c\n/* iscsiuio/src/uip/ipv6.c */\nstatic void ipv6_icmp_handle_echo_request(struct ipv6_context *context)\n{\n...\nipv6_send(context, (u8_t *) icmp - (u8_t *) eth +\nsizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6->ipv6_plen));\n}\n```\nLater, checksum generation also trusts `ipv6_plen` for memory traversal, \nand for odd lengths it writes a padding byte at `ptr + protocol_data_len` \nbefore iterating over `protocol_data_len` bytes:\n```c\n/* iscsiuio/src/uip/ipv6.c */\nprotocol_data_len = HOST_TO_NET16(ipv6->ipv6_plen);\n...\nif (protocol_data_len & 1) {\n*((u8_t *) ptr + protocol_data_len) = 0;\nprotocol_data_len++;\n}\nfor (i = 0; i < protocol_data_len / 2; i++) {\nsum += HOST_TO_NET16(*ptr);\nptr++;\n}\n```\nThe available receive-side logic does not establish a payload-length bound \nstrong enough to eliminate this condition. `uip_input()` compares the IPv6 \npayload length against `uip_len`, but `uip_len` is treated as full frame \nlength in the observed path rather than the actual IPv6 payload length, and \n`ipv6_rx_packet()` receives a `len` argument without using it to bound \nparsing. A forged `ipv6_plen` can therefore exceed the real IPv6 payload \nstored in the buffer. The available evidence supports MTU-bounded \nout-of-bounds access in normal receive paths rather than the earlier \narbitrary 64KB worst case. The affected logic appears to be present in the \navailable 6.2.1.11 code base, but this report is scoped to the scanned SRPM \npackage.\nSteps to reproduce:\n1. Build `iscsiuio` with ASAN enabled.\n2. Run `iscsiuio` with IPv6/NDP active on a test interface.\n3. From the same L2 segment, send an ICMPv6 Echo Request with `IPv6.plen` \nset larger than the actual payload bytes in the frame buffer; one tested \nshape is `plen=1491` with an Ethernet frame size near 1500 bytes.\n4. Observe the reply path: ASAN reports invalid access in \n`ipv6_insert_protocol_chksum()` as the checksum walk reads past valid \npacket data, odd lengths may also trigger a one-byte write, and reply \nsizing is derived from the forged `ipv6_plen` rather than the actual \nreceived payload size.\nMitigation: Until a fix is available, keep `iscsiuio`-managed interfaces on \ntrusted L2 segments only. Where operationally acceptable, disable IPv6 on \nthose interfaces or filter ICMPv6 Echo Requests before they reach \n`iscsiuio`. If `iscsiuio` is not processing IPv6/NDP traffic, this specific \npath is not reachable.\nProposed Fix: Clamp the reply payload length to the actual received payload \nderived from `context->ustack->uip_len`, reject packets too short to \ncontain a complete ICMPv6 header, and rewrite `ipv6->ipv6_plen` before \ncalling `ipv6_send()`.\n```diff\ndiff --git a/iscsiuio/src/uip/ipv6.c b/iscsiuio/src/uip/ipv6.c\n@@ -1100,6 +1100,8 @@ static void ipv6_icmp_handle_echo_request(struct \nipv6_context *context)\n{\nstruct eth_hdr *eth =\n(struct eth_hdr *)context->ustack->data_link_layer;\n+u16_t rx_total, rx_payload, hdr_plen, safe_plen;\n+u16_t l2_l3_len = sizeof(struct eth_hdr) + sizeof(struct ipv6_hdr);\nstruct ipv6_hdr *ipv6 =\n(struct ipv6_hdr *)context->ustack->network_layer;\nstruct icmpv6_hdr *icmp = (struct icmpv6_hdr *)((u8_t *)ipv6 +\n@@ -1126,8 +1128,20 @@ static void ipv6_icmp_handle_echo_request(struct \nipv6_context *context)\nicmp->icmpv6_code = 0;\nicmp->icmpv6_cksum = 0;\nILOG_DEBUG(\"IPv6: Send echo reply\");\n-ipv6_send(context, (u8_t *) icmp - (u8_t *) eth +\nsizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6>ipv6_plen));\n+\n+rx_total = context->ustack->uip_len;\n+if (rx_total <= l2_l3_len)\n+return;\n+\n+rx_payload = rx_total - l2_l3_len;\n+hdr_plen = HOST_TO_NET16(ipv6->ipv6_plen);\n+safe_plen = (hdr_plen <= rx_payload) ? hdr_plen : rx_payload;\n+if (safe_plen < sizeof(struct icmpv6_hdr))\n+return;\n+\n+ipv6->ipv6_plen = HOST_TO_NET16(safe_plen);\n+ipv6_send(context, l2_l3_len + safe_plen);\n+\nreturn;\n}\n```\n------\nThis report was generated using AI technology. Always review AI-generated \ncontent prior to use"], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure that `iscsiuio`-managed interfaces are restricted to trusted L2 network segments. If feasible for your operational environment, disable IPv6 on interfaces where `iscsiuio` is active and not strictly required to process IPv6 traffic. Alternatively, implement firewall rules to filter ICMPv6 Echo Requests before they reach the `iscsiuio` process on affected systems. Changes to network configurations may require a network service restart to take effect, which could temporarily impact network connectivity."}, "name": "CVE-2026-18725", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "iscsi-initiator-utils", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "iscsi-initiator-utils", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-12T15:21:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-18725\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-18725"], "statement": "Moderate: This flaw in `iscsi-initiator-utils` (specifically `iscsiuio`) allows an adjacent-network attacker to trigger out-of-bounds read and a potential one-byte write via crafted ICMPv6 Echo Requests. Exploitation requires `iscsiuio` to process IPv6/NDP traffic on a reachable interface. Red Hat products are affected when `iscsiuio` is configured to handle such traffic on an exposed network segment.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.2.1.11-0.git4b3e853.el10"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 84.0, "source": "matching"}]}, "product": "open-iscsi", "vendor": "open-iscsi_project"}], "created": "2026-08-13T13:20:05.614582+00:00", "updated": "2026-08-13T13:20:05.614616+00:00", "vendors": ["open-iscsi_project", "open-iscsi_project$PRODUCT$open-iscsi"]}