open-iscsi iscsiuio Out-of-Bounds Read Flaws

Heap out-of-bounds read in the iscsiuio DHCPv4 option parser, part of open-iscsi, allows an attacker on the same Layer-2 segment to send a crafted DHCP response that can crash the daemon, corrupt its network configuration, and potentially disclose limited heap data. Deployments at risk are those running iscsiuio for iSCSI offload, notably on Broadcom bnx2/cnic NICs, and using DHCP-driven iSCSI configuration; Red Hat tracks Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) was provided; the issue is rated moderate priority (this_week).

ARP/neighbor-table poisoning in the iscsiuio userspace daemon shipped with open-iscsi lets an unauthenticated attacker on the same Layer 2 segment redirect network traffic by sending a single minimal IPv6 Neighbor Advertisement. Affected deployments are those where iscsiuio is actually running for iSCSI hardware offload (typically with supported Broadcom NICs); a default server without iSCSI offload configured is not exposed. The same handler also reads link-layer address options at a fixed offset without confirming the packet carries them, an out-of-bounds read that can leak memory or crash the daemon; no public exploit has been identified at time of analysis.

An out-of-bounds heap read in open-iscsi's iscsiuio daemon allows an attacker on the same network segment to crash the daemon, overwrite a single heap byte, or corrupt the stored iSCSI initiator name by sending a crafted DHCPv6 Advertise message. The flaw is in the DHCPv6 option parser, which calls strlen() on raw option data that carries no guaranteed NUL terminator, so the scan walks past the end of the buffer; open-iscsi packages as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as affected, but only hosts that actually run iscsiuio and obtain iSCSI parameters over DHCPv6 (offload/boot deployments) are exposed, since the daemon is not default-active on typical systems. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; combined with the adjacency-only attack path this yields a medium severity (CVSS 6.3) and a this-month rather than emergency priority.