A flaw was found in open-iscsi. An integer underflow vulnerability in the iscsiuio component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the iscsiuio process crashing. This issue affects systems where iscsiuio is actively handling IPv4 DHCP traffic.
To mitigate this issue, restrict network access to iscsiuio-managed interfaces. Configure firewall rules to limit DHCP/BOOTP traffic to only trusted infrastructure within the local broadcast domain. This reduces the exposure to untrusted systems that could send crafted IPv4 DHCP packets. If iscsiuio is actively using IPv4 DHCP, consider reconfiguring it to use static IP addresses or a different network configuration if feasible. Changes to network configuration may require a service restart.