CVE-2026-115485 in Red Hat
Summary
by MITRE • 10/23/2026
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified within the iscsiuio component of open-iscsi represents a critical memory safety flaw rooted in improper input validation during network packet processing. Specifically, the defect resides in the Dynamic Host Configuration Protocol version six option parser, which handles DHCPv6 messages received by the iSCSI initiator service. When parsing these options, the software invokes the standard C library function strlen to determine the length of a string field contained within the raw network data buffer. The fundamental technical error is that this operation assumes the presence of a null terminator character at the end of the string without performing any prior verification or bounds checking against the actual size of the allocated buffer. In secure software engineering, relying on external input for string termination is inherently risky because network packets are untrusted sources that can be manipulated by adversaries to contain malformed data structures.
This lack of boundary validation leads directly to a heap-based out-of-bounds read condition. When the strlen function encounters raw network data lacking a null terminator within the expected buffer limits, it continues reading memory addresses sequentially until it eventually hits a zero byte or causes an access violation. This behavior results in several distinct operational impacts depending on the specific contents of the adjacent heap memory. In many scenarios, this out-of-bounds read can cause the iscsiuio daemon to crash due to accessing invalid memory pages, leading to a denial of service for iSCSI storage connectivity services running on the host. More critically, if the parsing logic subsequently uses the incorrectly calculated length to write data or manipulate pointers, it may result in a one-byte heap overwrite. Such overwrites can corrupt adjacent metadata structures within the heap allocator, potentially altering control flow or damaging critical application state variables such as the iSCSI initiator name configuration.
The exploitation of this vulnerability requires an attacker positioned on the same local network segment as the target system. By crafting and transmitting a malicious DHCPv6 Advertise message containing specifically designed option fields with missing null terminators, an adversary can trigger the flawed parsing logic remotely without requiring authentication or prior interaction with the service. This attack vector aligns with common patterns observed in network-based exploitation where untrusted protocol data is processed by privileged daemons. The ability to corrupt heap memory or crash a daemon provides potential pathways for further system compromise, including privilege escalation if the daemon runs with elevated privileges, or persistent denial of service that disrupts storage access for critical applications relying on iSCSI targets.
From a classification perspective, this vulnerability corresponds closely to CWE-125, which describes Out-of-bounds Read vulnerabilities where software reads data past the end, or before the beginning, of the intended buffer. It also exhibits characteristics of CWE-687 regarding Function Call With Incorrect Argument Type if the length calculation is misinterpreted by subsequent functions. In terms of adversary tactics, this flaw facilitates techniques associated with ATT&CK T1498, Network Denial of Service, as a crash or corruption effectively disrupts service availability. Furthermore, heap corruption issues often serve as precursors to more severe exploits like arbitrary code execution, making the remediation urgency high despite the current description focusing on crashes and minor overwrites.
Mitigation strategies should prioritize immediate patching through vendor-provided updates that address the open-iscsi package version containing this flaw. Developers must implement strict bounds checking before invoking string manipulation functions on raw network buffers to ensure that read operations never exceed the allocated buffer size. Additionally, input validation logic should explicitly verify the presence of null terminators within expected limits or use length-limited string functions such as strnlen instead of strlen when processing untrusted data from network sockets. Network segmentation and firewall rules can provide temporary defense-in-depth by restricting DHCPv6 traffic to trusted sources if possible, although this is often difficult in dynamic environments where iSCSI initiators rely on automatic configuration discovery. Regular security audits focusing on memory safety practices in C-based network daemons are essential to prevent similar vulnerabilities from being introduced during future development cycles.