Описание
A flaw was found in open-iscsi. An integer underflow vulnerability in the iscsiuio component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the iscsiuio process crashing. This issue affects systems where iscsiuio is actively handling IPv4 DHCP traffic.
Отчет
This flaw in iscsi-initiator-utils is rated Moderate. It allows an adjacent-network attacker to trigger a denial of service by sending a crafted IPv4/UDP DHCP reply to systems where iscsiuio is configured to use IPv4 DHCP. Exploitation requires specific network conditions and a vulnerable configuration, limiting its broader impact.
Меры по смягчению последствий
To mitigate this issue, restrict network access to iscsiuio-managed interfaces. Configure firewall rules to limit DHCP/BOOTP traffic to only trusted infrastructure within the local broadcast domain. This reduces the exposure to untrusted systems that could send crafted IPv4 DHCP packets. If iscsiuio is actively using IPv4 DHCP, consider reconfiguring it to use static IP addresses or a different network configuration if feasible. Changes to network configuration may require a service restart.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | iscsi-initiator-utils | Fix deferred | ||
| Red Hat Enterprise Linux 9 | iscsi-initiator-utils | Fix deferred |
Показывать по
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.
A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.
A flaw was found in open-iscsi. An integer underflow vulnerability in ...
A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.
6.5 Medium
CVSS3