Summary: The IPv6 Neighbor Discovery handlers in iscsiuio access the Link-Layer Address option at a fixed 24-byte offset without verifying the payload is long enough. A valid, RFC-compliant NA with no options causes a 1-byte heap OOB read. Additionally, an unconditional ARP table update with attacker-controlled source MAC/IP enables deterministic ARP table poisoning.

Component affected: iscsi-initiator-utils (iscsiuio), iscsiuio/src/uip/ipv6.c, ipv6_icmp_handle_nd_adv() (line 939) and ipv6_icmp_handle_nd_sol() (line 988).

Vulnerability Details:

Both ND handlers compute link_opt at a fixed 24-byte offset past the ICMPv6 header without checking payload length. Per RFC 4861, valid ND messages may have exactly 24 bytes payload (no options). With no options, link_opt points past the payload into heap.

Two issues in ipv6_icmp_handle_nd_adv():

1. DETERMINISTIC ARP POISONING (line 966): ipv6_update_arp_table() is called unconditionally with &ipv6->ipv6_src and &eth->src_mac — both attacker-controlled. Any NA deterministically poisons the ARP table. No heap byte matching needed.

2. HEAP OOB READ (line 971): link_opt->hdr.type reads 1 byte from heap. If it matches IPV6_ICMP_OPTION_TAR_ADDR (value 2, 1/256 probability), 6 bytes of heap data are written as a MAC address.

No upstream length validation exists. Commit c797fa7 clamps ipv6_plen in uip_process() but does NOT fix the no-option variant where ipv6_plen is valid (exactly 24).

Version affected: All versions including latest upstream master (a65ce4b). Confirmed unfixed: ASAN heap-buffer-overflow READ of size 1 at ipv6.c:997.

CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L - 6.8
C:L — heap byte disclosure via ARP table entry
I:H — deterministic ARP table poisoning with attacker-controlled addresses
A:L — corrupted ARP entries disrupt connectivity

Proposed Fix: Check plen >= 32 (24-byte ND header + 8-byte option) before dereferencing link_opt.

Upstream status: No fix exists. No upstream commit touches these functions.
Acknowledgement: Red Hat Product Security