Bug 2556266 (CVE-2026-115485)

Summary:	CVE-2026-115485 open-iscsi: open-iscsi: DHCPv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-20 15:50:32 UTC

Summary: The DHCPv6 vendor option parser in iscsiuio calls strlen() on raw network-received data with no NUL-terminator guarantee, causing an unbounded heap read. The result is used for a 1-byte NUL OOB write and an strcpy that corrupts the iSCSI initiator name with heap-derived data.

Component affected: iscsi-initiator-utils (iscsiuio), iscsiuio/src/apps/dhcpc/dhcpv6.c, dhcpv6_parse_vendor_option() (line 480).

Vulnerability Details:

dhcpv6_parse_vendor_option() at line 495 calls:
  data_len = strlen((char *)data)

where data points to raw network-received bytes from a DHCPv6 Vendor-Specific Information option (type 17), sub-option 203 (iSCSI initiator name). No NUL terminator is guaranteed. strlen() walks past the buffer into adjacent heap memory.

The returned length is then used for:
1. data[data_len] = '\0' at line 509 — 1-byte heap OOB write (NUL byte). data_len cap at ISCSI_MAX_ISCSI_NAME_LENGTH (128) limits offset but does NOT prevent strlen from reading arbitrarily far.
2. strcpy(context->initiatorName, (char *)data) at line 510 — copies up to 128 bytes of heap-derived data into the iSCSI initiator name, corrupting iSCSI identity configuration.

This bug is distinct from CVE-2026-18727 (integer underflow in ipv6_udp_handle_dhcp). This is in dhcpv6_parse_vendor_option() — completely different function and code path.

Attack preconditions: dhcpv6_state must be DHCPV6_STATE_SOLICIT_SENT (timing window during DHCPv6 boot, reliably reachable every boot). Attacker controls VENDOR_CLASS option to match dhcp_vendor_id. L2-adjacent access required.

Version affected: All versions including latest upstream master (a65ce4b). Confirmed unfixed: ASAN heap-buffer-overflow READ of size 163 in strlen, called from dhcpv6_parse_vendor_option.

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H - 8.3
C:H — strlen walks heap arbitrarily; strcpy copies heap data into named buffer
I:L — strcpy into initiatorName corrupts iSCSI identity; NUL write can corrupt heap metadata
A:H — reliable crash from OOB read or heap corruption

Proposed Fix: Replace strlen() with strnlen() bounded by the option's declared length.

Upstream status: No fix exists. No upstream commit touches dhcpv6_parse_vendor_option().
Acknowledgement: Red Hat Product Security