IPv6 Neighbor Discovery validation flaw in Red Hat Enterprise Linux iscsi-initiator-utils enables ARP table poisoning

A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.

• Red Hat Enterprise Linux 7: iscsi-initiator-utils-iscsiuio, iscsi-initiator-utils.src, and iscsi-initiator-utils-devel are marked affected.
• Red Hat Enterprise Linux 8: iscsi-initiator-utils, iscsi-initiator-utils-iscsiuio, iscsi-initiator-utils.src, iscsi-initiator-utils-devel, and python3-iscsi-initiator-utils are marked affected.
• Red Hat Enterprise Linux 9: iscsi-initiator-utils, iscsi-initiator-utils-iscsiuio, iscsi-initiator-utils.src, and python3-iscsi-initiator-utils are marked affected.
• Red Hat Enterprise Linux 10: iscsi-initiator-utils, iscsi-initiator-utils-iscsiuio, iscsi-initiator-utils.src, and python3-iscsi-initiator-utils are marked affected.
• Red Hat marks iscsi-initiator-utils.src and iscsi-initiator-utils-devel for Red Hat Enterprise Linux 6 as not affected because the vulnerable code is not present. This does not establish that every package or configuration in that branch is unaffected.
• No specific affected package versions or exact fixed release are identified in the available evidence; Red Hat currently records no remediation as available for the affected products.

The flaw is in the iscsiuio component of open-iscsi, in IPv6 Neighbor Discovery processing under iscsiuio/src/uip/ipv6.c. The Neighbor Advertisement and Neighbor Solicitation handlers calculate the link-layer address option at a fixed 24-byte offset past the ICMPv6 header without checking the payload length first. A valid Neighbor Advertisement with no options can therefore cause an option-type read beyond the packet data, matching CWE-125. The Neighbor Advertisement path also updates the ARP table unconditionally with the packet's IPv6 source address and Ethernet source MAC, both of which are attacker-controlled header values. The ARP poisoning does not depend on heap manipulation or on option data matching a particular value. Reachability requires iscsiuio to process IPv6 NDP traffic on a hardware iSCSI offload NIC; the daemon is socket-activated and runs only when the hardware is present and configured. The mapping between specific package builds and a fixed release is not established.

An attacker needs access to the same Layer 2 network segment as the target, but does not need authentication or user interaction. Complexity is low because a minimal Neighbor Advertisement can reach the vulnerable processing path. Red Hat describes the ARP poisoning component as reliably exploitable from the local segment without heap manipulation. Actual exploitability still depends on the system having a hardware iSCSI offload NIC, a configured related interface, and active NDP processing by iscsiuio. The available evidence does not establish active exploitation or a public exploit.

• The confirmed technical outcome is an ARP table update using attacker-controlled MAC and IP addresses, which can redirect traffic within the local segment.
• Exploitation requires an attacker able to send traffic on the same Layer 2 network, but does not require an account or user interaction.
• A separate processing path performs an out-of-bounds read when a Neighbor Discovery packet lacks the option expected at the fixed offset. The available evidence does not establish that this read leads to code execution.
• Red Hat limits the described impact to the iSCSI storage network, with possible effects on traffic integrity and connection availability. There is no basis to assert a specific data compromise or breach.

ARP poisoning can change the path of traffic between hosts and services in an iSCSI storage network. Realistic consequences include traffic redirection, loss of communication integrity, and disruption of storage connectivity or operations. Red Hat describes the impact as limited to traffic redirection within the iSCSI storage network rather than the entire host network. The available evidence does not confirm data access, a specific intrusion, or an information disclosure incident.

1. No confirmed update or exact fixed release is currently available for the affected products. Monitor Red Hat advisories and apply the official fix for the relevant product branch when published; do not assume that a fix for one branch applies automatically to another branch.
2. Keep iscsiuio-managed interfaces on trusted, isolated Layer 2 segments and away from uncontrolled sources.
3. Where compatible with the network and storage design, filter ICMPv6 Neighbor Advertisement type 136 and Neighbor Solicitation type 135 messages from untrusted sources with firewall controls. Assess operational impact before deployment because these messages are part of Neighbor Discovery.
4. Prioritize segmentation and filtering for systems with hardware iSCSI offload NICs, configured iscsiuio, and active IPv6 NDP processing. Do not treat missing logs or the absence of observed packets as proof that a system is unaffected.

1. Inventory Red Hat Enterprise Linux systems containing iscsi-initiator-utils, especially iscsi-initiator-utils-iscsiuio, source, development, and related Python packages.
2. Identify systems with hardware iSCSI offload NICs, interfaces managed by iscsiuio, and socket activation or configuration that allows the daemon to process IPv6 NDP.
3. On those interfaces, review ICMPv6 Neighbor Advertisement type 136 and Neighbor Solicitation type 135 traffic from untrusted sources. This is precautionary monitoring, not a confirmed IOC.
4. Compare unexpected ARP or neighbor-cache changes with the expected MAC and IP mappings, and investigate changes associated with traffic redirection or connectivity disruption in the iSCSI storage network.
5. Where source or debug packages are available, inspect ipv6_icmp_handle_nd_adv() and ipv6_icmp_handle_nd_sol() for length validation before dereferencing the option pointer. The absence of suspicious network events does not prove that a system is safe.