Bug 2556267 (CVE-2026-115486)

Summary:	CVE-2026-115486 open-iscsi: open-iscsi: IPv6 Neighbor Discovery missing option length validation in iscsiuio allows ARP table poisoning
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-20 15:50:52 UTC

Summary: The IPv6 Neighbor Discovery handlers in iscsiuio access the Link-Layer Address option at a fixed 24-byte offset without verifying the payload is long enough. A valid, RFC-compliant NA with no options causes a 1-byte heap OOB read. Additionally, an unconditional ARP table update with attacker-controlled source MAC/IP enables deterministic ARP table poisoning.

Component affected: iscsi-initiator-utils (iscsiuio), iscsiuio/src/uip/ipv6.c, ipv6_icmp_handle_nd_adv() (line 939) and ipv6_icmp_handle_nd_sol() (line 988).

Vulnerability Details:

Both ND handlers compute link_opt at a fixed 24-byte offset past the ICMPv6 header without checking payload length. Per RFC 4861, valid ND messages may have exactly 24 bytes payload (no options). With no options, link_opt points past the payload into heap.

Two issues in ipv6_icmp_handle_nd_adv():

1. DETERMINISTIC ARP POISONING (line 966): ipv6_update_arp_table() is called unconditionally with &ipv6->ipv6_src and &eth->src_mac — both attacker-controlled. Any NA deterministically poisons the ARP table. No heap byte matching needed.

2. HEAP OOB READ (line 971): link_opt->hdr.type reads 1 byte from heap. If it matches IPV6_ICMP_OPTION_TAR_ADDR (value 2, 1/256 probability), 6 bytes of heap data are written as a MAC address.

No upstream length validation exists. Commit c797fa7 clamps ipv6_plen in uip_process() but does NOT fix the no-option variant where ipv6_plen is valid (exactly 24).

Version affected: All versions including latest upstream master (a65ce4b). Confirmed unfixed: ASAN heap-buffer-overflow READ of size 1 at ipv6.c:997.

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - 6.8
C:L — heap byte disclosure via ARP table entry
I:H — deterministic ARP table poisoning with attacker-controlled addresses
A:L — corrupted ARP entries disrupt connectivity

Proposed Fix: Check plen >= 32 (24-byte ND header + 8-byte option) before dereferencing link_opt.

Upstream status: No fix exists. No upstream commit touches these functions.
Acknowledgement: Red Hat Product Security