Debian Patches

Status for open-iscsi/2.1.8-1+deb12u1

Patch Description Author Forwarded Bugs Origin Last update
lp1755858-default-iscsid_conf-to-iscsid_socket.patch default in iscid.conf to use iscsid.socket
People do not want iscsid to run if not needed.
To do so it is configured to be socket activated.
Internally iscsid code has a fallback if the service is missing to run the
command specified in iscsid.conf as "iscsid.startup".
Set this to ensure the socket is active instead of calling the binary, which
would not be what we want anyway as it would not be from the .service context.


===================================================================		 Christian Ehrhardt <christian.ehrhardt@canonical.com> no 2020-08-13
multiarch-path.patch =================================================================== no
CVE-2026-18724.patch idbm: fix stack buffer overflow in idbm_recinfo_config()
Add bounds checking when parsing configuration file keys and values to
prevent stack buffer overflow.

The idbm_recinfo_config() function parses configuration files and copies
keys into a 128-byte stack buffer (name) and values into a 256-byte stack
buffer (value) without bounds checking. An attacker with the ability to
create or modify configuration files could craft entries with oversized
keys or values to overflow these buffers, potentially causing crashes or
memory corruption.

This patch adds proper bounds checking to both parsing loops:
- Keys are limited to NAME_MAXVAL-1 (127) bytes
- Values are limited to VALUE_MAXVAL-1 (255) bytes
- A warning is logged and parsing stops when limits are exceeded

While the SendTargets discovery attack vector mentioned in security
reports is mitigated by existing iqn_name_valid() validation that
rejects control characters, this fix provides defense-in-depth protection
against other potential input vectors such as direct configuration file
manipulation or future code changes.		 Chris Leech <cleech@redhat.com> yes debian upstream https://github.com/open-iscsi/open-iscsi/pull/544/changes/19bd8dfb4c2713ade3d662961f4407e8f5613c4e 2026-08-19
CVE-2026-18725.patch iscsiuio: fix out-of-bounds access in IPv6 ICMPv6 echo handling
Validate IPv6 payload length against actual received data to prevent
out-of-bounds reads and writes in ICMPv6 echo request processing.

The ipv6_icmp_handle_echo_request() function trusts the ipv6_plen field
from incoming ICMPv6 Echo Request packets without validating it against
the actual received packet size. An attacker on the same L2 segment can
send a crafted Echo Request with a forged ipv6_plen larger than the
actual payload.

This leads to two vulnerabilities in ipv6_insert_protocol_chksum():
1. Out-of-bounds READ: The checksum calculation iterates over
ipv6_plen/2 16-bit words, reading past the valid packet buffer
2. Out-of-bounds WRITE: For odd lengths, a zero padding byte is written
at offset ipv6_plen, which can be beyond the buffer boundary

The fix validates the payload length by:
- Calculating the actual received IPv6 payload from context->ustack->uip_len
- Clamping the header's ipv6_plen to the actual received payload size
- Rejecting packets too small to contain a valid ICMPv6 header
- Rewriting the ipv6_plen field with the validated length before sending

This prevents MTU-bounded information disclosure via out-of-bounds reads
and memory corruption via the one-byte out-of-bounds write.

Attack requires adjacent network access (same L2 segment) but no
authentication or user interaction. Impact is moderate due to deployment
dependency on iscsiuio processing IPv6 traffic.		 Chris Leech <cleech@redhat.com> yes debian upstream https://github.com/open-iscsi/open-iscsi/pull/544/changes/f7fe7adbbf0146cea77951f65ea04dd44c699ebc 2026-08-19
CVE-2026-18726.patch iscsiuio: fix Router Advertisement parsing vulnerabilities
Fix multiple security issues in ICMPv6 Router Advertisement option parsing:

1. Integer underflow: When ipv6_plen is less than the Router Advertisement
header size (16 bytes), the opt_len calculation underflows, creating a
huge value that drives out-of-bounds reads.

2. Infinite loop: Zero-length options (RFC 4861 violation) cause the parser
to hang indefinitely as the loop counter never advances.

3. Out-of-bounds read: The loop condition allowed accessing option headers
when insufficient space remained in the payload.

The fix adds comprehensive validation:
- Reject packets with ipv6_plen < sizeof(icmpv6_router_advert)
- Check for option header space before dereferencing
- Detect and reject zero-length options
- Validate option step size doesn't exceed remaining space		 Chris Leech <cleech@redhat.com> yes debian upstream https://github.com/open-iscsi/open-iscsi/pull/544/changes/99356c0c93e3c2e6ec5d63131d8cb20b4d3ce4e1 2026-08-19
CVE-2026-18727.patch iscsiuio: fix integer underflow in DHCPv6 packet parsing
DHCPv6 packet processing did not validate UDP length before
calculating DHCPv6 payload size, allowing integer underflow when
udp->length < sizeof(struct udp_hdr). The underflowed value was then
used as a loop bound for option parsing, leading to out-of-bounds
reads and likely process crash.

Add two layers of validation:

1. In ipv6_udp_rx(): Validate packet sizes before dispatching to
DHCPv6 handler. Check that both IPv6 payload length and UDP length
are sufficient for UDP + DHCPv6 headers, and that UDP length is
consistent with IPv6 payload length.

2. In ipv6_udp_handle_dhcp(): Prevent integer underflow by checking
that udp_len >= sizeof(struct udp_hdr) before subtracting, and
validate the resulting dhcpv6_len is large enough for DHCPv6 header.

This prevents adjacent network attackers from crashing iscsiuio by
sending malformed DHCPv6 packets with forged short UDP lengths.		 Chris Leech <cleech@redhat.com> yes debian upstream https://github.com/open-iscsi/open-iscsi/pull/544/changes/23066b27e75e3a3a179fd4b3a25f1f11bd43c79c 2026-08-19
CVE-2026-18728.patch iscsiuio: fix integer underflow in IPv4 payload length calculation
IPv4 packet processing in uip_process() did not validate that the
IPv4 Total Length field was large enough to contain the required
headers before subtracting header sizes, allowing integer underflow
when malformed packets with short total lengths were received.

In the UDP path, if Total Length < 28 bytes (IPv4 + UDP headers),
the subtraction uip_len - uip_ip_udph_len would underflow, wrapping
to a large value (~65528). This underflowed length was then used by
the DHCP parser as a trusted payload size, leading to out-of-bounds
reads and process crashes.

The TCP path had the same issue with Total Length < 40 bytes
(IPv4 + TCP headers minimum).

Add validation before both subtractions:

1. UDP path: Check uip_len >= uip_ip_udph_len (28 bytes) before
subtracting. Drop packet and log if invalid.

2. TCP path: Check uip_len >= (tcp_hdr_len + ip_hdr_len) before
subtracting. Drop packet and log if invalid.

This prevents adjacent network attackers from crashing iscsiuio by
sending malformed IPv4 packets with forged short Total Length values,
particularly in DHCP-enabled deployments.		 Chris Leech <cleech@redhat.com> yes debian upstream https://github.com/open-iscsi/open-iscsi/pull/544/changes/5d6729dbb4cc275f55dcd0a6f8749f53640d33d2 2026-08-19
CVE-2026-44943.patch Improve iscsid discovery handling of IQN names.
Currently, IQN names received via discovery are assumed to be valid up
to the NULL character, i.e. the end of the supplied string. But this
may not be correct.

The ASCII characters allowed in an IQN are detailed in RFC 3722, section
6.2: "Currently Prohibited ASCII Characters".

Disallowing such characters should not break current usage, since the
disallowed characters should not be in an IQN anyway. For example, they
include characters like forward slashes, backward slashes, spaces,
control characters, etc..

Open-iscsi uses target names as directory names in the "database"
directory (typically /var/lib/iscsi), so fixing this eliminates discovery
target name containing sequences like "../../../*" from being allowed.		 Lee Duncan <lduncan@suse.com> no debian https://github.com/open-iscsi/open-iscsi/commit/3f747d10ce743483a5d5e9512eb28a08b12d9677 2026-07-14
CVE-2026-44944.patch Fix iscsiuio control-socket credential verification.
Prevent unprivilidged user from driving the isscsiuio control socket,
by validating connection against correct file descriptor.		 Lee Duncan <lduncan@suse.com> no debian https://github.com/open-iscsi/open-iscsi/pull/535/changes/61548b598cce28b3042073dd546e2609777fa3a5 2026-07-14

All known versions for source package 'open-iscsi'

Links