Bug 2462023 (CVE-2026-18725)

AI_ONLY_REPORT
package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10
------
Summary: Out-of-Bounds Write and Information Disclosure via Unvalidated  
IPv6 Payload Length: crafted ICMPv6 Echo Requests can cause `iscsiuio` to  
trust an inflated `ipv6_plen` larger than the actual received payload,  
leading to MTU-bounded out-of-bounds reads and a potential one-byte  
out-of-bounds write that may disclose data beyond the valid packet boundary.
Requirements to exploit: Adjacent-network access on the same L2 segment as  
a system running `iscsiuio` on an interface that processes IPv6/NDP  
traffic, plus the ability to send a crafted ICMPv6 Echo Request with a  
forged `IPv6.plen`. No authentication or user interaction is required.
Component affected: `iscsi-initiator-utils` (`iscsiuio`):  
`iscsiuio/src/uip/ipv6.c` in `ipv6_icmp_handle_echo_request()` and  
`ipv6_insert_protocol_chksum()`.
Version affected: `iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10` when  
`iscsiuio` is processing IPv6/NDP traffic on a reachable interface.
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - 6.3 (MEDIUM)
AV:A - Reachability is limited to an attacker on the same L2 segment who  
can send crafted IPv6/ICMPv6 traffic to the affected interface.
AC:L - The attack relies on forging `IPv6.plen`; no race or unusual  
environment is needed beyond the vulnerable deployment.
PR:N - No privileges are required.
UI:N - No user interaction is required.
S:U - The impact remains within the `iscsiuio` process and its packet  
buffer handling.
C:L - The reply/checksum path can read and potentially transmit data  
beyond the valid packet boundary, but the demonstrated exposure is  
MTU-bounded.
I:L - For odd forged lengths, the checksum path can write a single  
padding byte past the valid protocol data, which may affect adjacent buffer  
contents.
A:L - Invalid memory access may destabilize or crash the process, but  
reliable high-impact denial of service is not established from the  
available evidence.
Impact: Moderate. Under Red Hat's severity guidance, this is more  
consistent with a flaw that can affect confidentiality, integrity, or  
availability under constrained circumstances than with an Important issue.  
The bug is unauthenticated and adjacent-network reachable, but the  
currently supported outcome is MTU-bounded out-of-bounds access in a  
deployment-dependent IPv6/NDP path, not easy remote system compromise or  
clearly high-impact memory corruption.
Embargo: no
Reason: The currently supported impact is Moderate, exposure depends on  
`iscsiuio` processing IPv6 traffic on a reachable L2 segment, and operators  
can reduce exposure operationally by isolating or disabling the affected  
path.
Acknowledgement: Aisle Research
Vulnerability Details: In the ICMPv6 echo-reply path, the code reuses the  
inbound `ipv6_plen` field when sizing the reply instead of clamping it to  
the bytes actually received:
```c
/* iscsiuio/src/uip/ipv6.c */
static void ipv6_icmp_handle_echo_request(struct ipv6_context *context)
{
...
ipv6_send(context, (u8_t *) icmp - (u8_t *) eth +
sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6->ipv6_plen));
}
```
Later, checksum generation also trusts `ipv6_plen` for memory traversal,  
and for odd lengths it writes a padding byte at `ptr + protocol_data_len`  
before iterating over `protocol_data_len` bytes:
```c
/* iscsiuio/src/uip/ipv6.c */
protocol_data_len = HOST_TO_NET16(ipv6->ipv6_plen);
...
if (protocol_data_len & 1) {
*((u8_t *) ptr + protocol_data_len) = 0;
protocol_data_len++;
}
for (i = 0; i < protocol_data_len / 2; i++) {
sum += HOST_TO_NET16(*ptr);
ptr++;
}
```
The available receive-side logic does not establish a payload-length bound  
strong enough to eliminate this condition. `uip_input()` compares the IPv6  
payload length against `uip_len`, but `uip_len` is treated as full frame  
length in the observed path rather than the actual IPv6 payload length, and  
`ipv6_rx_packet()` receives a `len` argument without using it to bound  
parsing. A forged `ipv6_plen` can therefore exceed the real IPv6 payload  
stored in the buffer. The available evidence supports MTU-bounded  
out-of-bounds access in normal receive paths rather than the earlier  
arbitrary 64KB worst case. The affected logic appears to be present in the  
available 6.2.1.11 code base, but this report is scoped to the scanned SRPM  
package.
Steps to reproduce:
1. Build `iscsiuio` with ASAN enabled.
2. Run `iscsiuio` with IPv6/NDP active on a test interface.
3. From the same L2 segment, send an ICMPv6 Echo Request with `IPv6.plen`  
set larger than the actual payload bytes in the frame buffer; one tested  
shape is `plen=1491` with an Ethernet frame size near 1500 bytes.
4. Observe the reply path: ASAN reports invalid access in  
`ipv6_insert_protocol_chksum()` as the checksum walk reads past valid  
packet data, odd lengths may also trigger a one-byte write, and reply  
sizing is derived from the forged `ipv6_plen` rather than the actual  
received payload size.
Mitigation: Until a fix is available, keep `iscsiuio`-managed interfaces on  
trusted L2 segments only. Where operationally acceptable, disable IPv6 on  
those interfaces or filter ICMPv6 Echo Requests before they reach  
`iscsiuio`. If `iscsiuio` is not processing IPv6/NDP traffic, this specific  
path is not reachable.
Proposed Fix: Clamp the reply payload length to the actual received payload  
derived from `context->ustack->uip_len`, reject packets too short to  
contain a complete ICMPv6 header, and rewrite `ipv6->ipv6_plen` before  
calling `ipv6_send()`.
```diff
diff --git a/iscsiuio/src/uip/ipv6.c b/iscsiuio/src/uip/ipv6.c
@@ -1100,6 +1100,8 @@ static void ipv6_icmp_handle_echo_request(struct  
ipv6_context *context)
{
struct eth_hdr *eth =
(struct eth_hdr *)context->ustack->data_link_layer;
+	u16_t rx_total, rx_payload, hdr_plen, safe_plen;
+	u16_t l2_l3_len = sizeof(struct eth_hdr) + sizeof(struct ipv6_hdr);
struct ipv6_hdr *ipv6 =
(struct ipv6_hdr *)context->ustack->network_layer;
struct icmpv6_hdr *icmp = (struct icmpv6_hdr *)((u8_t *)ipv6 +
@@ -1126,8 +1128,20 @@ static void ipv6_icmp_handle_echo_request(struct  
ipv6_context *context)
icmp->icmpv6_code = 0;
icmp->icmpv6_cksum = 0;
ILOG_DEBUG("IPv6: Send echo reply");
-	ipv6_send(context, (u8_t *) icmp - (u8_t *) eth +
sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6>ipv6_plen));
+
+	rx_total = context->ustack->uip_len;
+	if (rx_total <= l2_l3_len)
+		return;
+
+	rx_payload = rx_total - l2_l3_len;
+	hdr_plen = HOST_TO_NET16(ipv6->ipv6_plen);
+	safe_plen = (hdr_plen <= rx_payload) ? hdr_plen : rx_payload;
+	if (safe_plen < sizeof(struct icmpv6_hdr))
+		return;
+
+	ipv6->ipv6_plen = HOST_TO_NET16(safe_plen);
+	ipv6_send(context, l2_l3_len + safe_plen);
+
return;
}
```
------
This report was generated using AI technology. Always review AI-generated  
content prior to use