diff --git a/SOURCES/0001-Fix-incorrect-parsing-of-node.discovery_type-static-.patch b/SOURCES/0001-Fix-incorrect-parsing-of-node.discovery_type-static-.patch new file mode 100644 index 0000000..473f65f --- /dev/null +++ b/SOURCES/0001-Fix-incorrect-parsing-of-node.discovery_type-static-.patch @@ -0,0 +1,59 @@ +From 290d16d6c6b6f4c78af119eb874484b2f995dc23 Mon Sep 17 00:00:00 2001 +From: Mike Andrews +Date: Sun, 28 Dec 2025 19:19:39 -0500 +Subject: [PATCH 1/1] Fix incorrect parsing of node.discovery_type "static" and + "fw" (#518) + +Remove the unused DISCOVERY_TYPE_SLP enumeration value so that the strings +"static" and "fw" map to the correct enum values. + +Previous versions supported an "slp" discovery_type. In d1d456cf28cd89, the +"slp" string was removed from the list of TYPE_INT_O string arguments when +processing DISC_TYPE and NODE_DISC_TYPE records in idbm_recinfo_discovery and +_idbm_node_rec_link. But, it was left in the discovery_type enum. The +resulting parsing logic would then map the string values "static" and "fw" to +the wrong enum values, and thus logic with unique action on +DISCOVERY_TYPE_STATIC and DISCOVERY_TYPE_FW did the wrong thing. Specifically, + +- "static" mapped to DISCOVERY_TYPE_SLP, and +- "fw" mapped to DISCOVERY_TYPE_STATIC. + +One manifestation of this bug is that you can no longer use iscsiadm to +manipulate or delete nodes with discovery_type = "static", as it falls through +to the default case in setup_disc_to_node_link. + +Fixes #463. +--- + libopeniscsiusr/idbm.h | 2 -- + usr/config.h | 2 -- + 2 files changed, 4 deletions(-) + +diff --git a/libopeniscsiusr/idbm.h b/libopeniscsiusr/idbm.h +index 0b201f4..512851d 100644 +--- a/libopeniscsiusr/idbm.h ++++ b/libopeniscsiusr/idbm.h +@@ -78,8 +78,6 @@ enum discovery_type { + DISCOVERY_TYPE_SENDTARGETS, + DISCOVERY_TYPE_ISNS, + DISCOVERY_TYPE_OFFLOAD_SENDTARGETS, +- /* SLP is Not Used -- kept as place holder */ +- DISCOVERY_TYPE_SLP_NOT_IMPLEMENTED, + DISCOVERY_TYPE_STATIC, + DISCOVERY_TYPE_FW, + }; +diff --git a/usr/config.h b/usr/config.h +index a38a25d..94a8ad0 100644 +--- a/usr/config.h ++++ b/usr/config.h +@@ -161,8 +161,6 @@ typedef enum discovery_type { + DISCOVERY_TYPE_SENDTARGETS, + DISCOVERY_TYPE_ISNS, + DISCOVERY_TYPE_OFFLOAD_SENDTARGETS, +- /* SLP is Not Used -- kept as place holder */ +- DISCOVERY_TYPE_SLP_NOT_IMPLEMENTED, + DISCOVERY_TYPE_STATIC, + DISCOVERY_TYPE_FW, + } discovery_type_e; +-- +2.54.0 + diff --git a/SOURCES/iscsi-initiator-utils-6.2.1.11-RHEL-219481.patch b/SOURCES/iscsi-initiator-utils-6.2.1.11-RHEL-219481.patch new file mode 100644 index 0000000..8b25dd8 --- /dev/null +++ b/SOURCES/iscsi-initiator-utils-6.2.1.11-RHEL-219481.patch @@ -0,0 +1,209 @@ +From 24f1c660510037dccb5ac7f81a9e9da4be455f77 Mon Sep 17 00:00:00 2001 +From: Lee Duncan +Date: Tue, 14 Jul 2026 12:16:58 -0700 +Subject: [PATCH] Fix security issues recently discovered by Keith at Linneman + Labs (#535) + +* Fix iscsiuio control-socket credential verification. + +Prevent unprivilidged user from driving the isscsiuio control socket, +by validating connection against correct file descriptor. + +Reference: CVE-2026-44944 +Found-by: + +* Improve iscsid discovery handling of IQN names. + +Currently, IQN names received via discovery are assumed to be valid up +to the NULL character, i.e. the end of the supplied string. But this +may not be correct. + +The ASCII characters allowed in an IQN are detailed in RFC 3722, section +6.2: "Currently Prohibited ASCII Characters". + +Disallowing such characters should not break current usage, since the +disallowed characters should not be in an IQN anyway. For example, they +include characters like forward slashes, backward slashes, spaces, +control characters, etc.. + +Open-iscsi uses target names as directory names in the "database" +directory (typically /var/lib/iscsi), so fixing this eliminates discovery +target name containing sequences like "../../../*" from being allowed. + +Reference: CVE-2026-44943 +Found-by: +--- + iscsiuio/src/unix/iscsid_ipc.c | 4 ++-- + usr/discovery.c | 18 ++++++++++++++++++ + usr/initiator.h | 3 +++ + usr/initiator_common.c | 33 +++++++++++++++++++++++++++++++++ + usr/iscsiadm.c | 4 ++++ + usr/iscsistart.c | 5 ++++- + 6 files changed, 64 insertions(+), 3 deletions(-) + +diff --git a/iscsiuio/src/unix/iscsid_ipc.c b/iscsiuio/src/unix/iscsid_ipc.c +index bcd6437..c4740fa 100644 +--- a/iscsiuio/src/unix/iscsid_ipc.c ++++ b/iscsiuio/src/unix/iscsid_ipc.c +@@ -1120,10 +1120,10 @@ static void *iscsid_loop(void *arg) + continue; + } + +- if (!mgmt_peeruser(iscsid_opts.fd, user) || strncmp(user, "root", PEERUSER_MAX)) { ++ if (!mgmt_peeruser(s2, user) || strncmp(user, "root", PEERUSER_MAX)) { + close(s2); + ILOG_ERR(PFX "Access error: non-administrative connection rejected"); +- break; ++ continue; + } + + /* this closes the file descriptor s2 */ +diff --git a/usr/discovery.c b/usr/discovery.c +index c163128..9317f39 100644 +--- a/usr/discovery.c ++++ b/usr/discovery.c +@@ -138,7 +138,9 @@ int discovery_isns_query(struct discovery_rec *drec, const char *iname, + uint32_t status; + int rc; + ++ + isns_config.ic_security = 0; ++ + source = isns_source_create_iscsi(iname); + if (!source) + return ISCSI_ERR_NOMEM; +@@ -216,6 +218,11 @@ int discovery_isns_query(struct discovery_rec *drec, const char *iname, + continue; + } + ++ if (!iqn_name_valid(pg_tgt)) { ++ log_error("iSNS discovery Target Name invalid: ignoring it"); ++ continue; ++ } ++ + if (!isns_object_get_ipaddr(obj, ISNS_TAG_PG_PORTAL_IP_ADDR, + &in_addr)) { + log_debug(1, "Missing addr"); +@@ -294,6 +301,11 @@ static int discovery_isns_reg_node(const char *iname, int op_reg) + log_debug(1, "trying to %s %s with iSNS server.", + op_reg ? "register" : "deregister", iname); + ++ if (!iqn_name_valid(iname)) { ++ log_error("iSNS initiatorname invalid: ignoring it"); ++ return ISCSI_ERR_INVAL; ++ } ++ + source = isns_source_create_iscsi(iname); + if (!source) + return ISCSI_ERR_NOMEM; +@@ -613,6 +625,12 @@ add_target_record(char *name, char *end, discovery_rec_t *drec, + log_error("TargetName %s too long, ignoring", name); + return 0; + } ++ ++ if (!iqn_name_valid(name)) { ++ log_error("Discovery TargetName invalid, ignoring"); ++ return 0; ++ } ++ + text = name + length; + + /* skip NULs after the name */ +diff --git a/usr/initiator.h b/usr/initiator.h +index b174168..6c56a9f 100644 +--- a/usr/initiator.h ++++ b/usr/initiator.h +@@ -21,6 +21,7 @@ + #define INITIATOR_H + + #include ++#include + #include + #include + +@@ -411,4 +412,6 @@ extern int iscsi_set_net_config(struct iscsi_transport *t, + extern void iscsi_session_init_params(struct iscsi_session *session); + + extern int session_in_use(int sid); ++ ++extern bool iqn_name_valid(const char *name); + #endif /* INITIATOR_H */ +diff --git a/usr/initiator_common.c b/usr/initiator_common.c +index 80b7652..3d58023 100644 +--- a/usr/initiator_common.c ++++ b/usr/initiator_common.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + + #include "iface.h" +@@ -749,3 +750,35 @@ int iscsi_host_set_net_params(struct iface_rec *iface, + } + return 0; + } ++ ++/** ++ * @brief iqn_name_valid -- return whether or not the supplied ++ * IQN name valid ++ * ++ * @details Checks for invalid characters, using RFC 3722, ++ * section 6.2, "Currently Prohibited ASCII Characters" ++ * ++ * @param name the IQN name we are checking ++ * @return true iff the whole name (string) has valid ++ * charaters ++ */ ++bool ++iqn_name_valid(const char *name) ++{ ++ unsigned char *cp; ++ ++ /* ensure no invalid characters */ ++ for (cp = name; *cp != '\0'; cp++) ++ if ((*cp <= '\x2c') || ++ (*cp == '\x2f') || ++ ((*cp >= '\x3b') && (*cp <= '\x40')) || ++ ((*cp >= '\x5b') && (*cp <= '\x60')) || ++ (*cp >= '\x7b')) { ++ log_debug(8, "IQN name is invalid: \"%s\" (char: '%#02x')", ++ name, *cp); ++ return false; ++ } ++ ++ log_debug(8, "IQN name has all valid characters: \"%s\"", name); ++ return true; ++} +diff --git a/usr/iscsiadm.c b/usr/iscsiadm.c +index 340ac5a..d7b9234 100644 +--- a/usr/iscsiadm.c ++++ b/usr/iscsiadm.c +@@ -1165,6 +1165,10 @@ exec_disc_op_on_recs(discovery_rec_t *drec, struct list_head *rec_list, + if (op & OP_NEW || op & OP_UPDATE) { + /* now add/update records */ + list_for_each_entry(new_rec, rec_list, list) { ++ if (!iqn_name_valid(new_rec->name)) { ++ log_error("FW discovery Target Name invalid: ignoring it"); ++ continue; ++ } + rc = idbm_add_node(new_rec, drec, op & OP_UPDATE); + if (rc) + log_error("Could not add/update " +diff --git a/usr/iscsistart.c b/usr/iscsistart.c +index df92d24..6f133d6 100644 +--- a/usr/iscsistart.c ++++ b/usr/iscsistart.c +@@ -403,7 +403,10 @@ int main(int argc, char *argv[]) + case 't': + check_str_param_len(optarg, TARGET_NAME_MAXLEN, + "targetname"); +- strlcpy(config_rec.name, optarg, TARGET_NAME_MAXLEN); ++ if (!iqn_name_valid(optarg)) ++ log_error("iscsistart Target Name invalid: ignoring"); ++ else ++ strlcpy(config_rec.name, optarg, TARGET_NAME_MAXLEN); + break; + case 'g': + config_rec.tpgt = atoi(optarg); diff --git a/SPECS/iscsi-initiator-utils.spec b/SPECS/iscsi-initiator-utils.spec index 5098044..8435fbf 100644 --- a/SPECS/iscsi-initiator-utils.spec +++ b/SPECS/iscsi-initiator-utils.spec @@ -10,14 +10,17 @@ Summary: iSCSI daemon and utility programs Name: iscsi-initiator-utils Version: 6.%{open_iscsi_version}.%{open_iscsi_build} -Release: 0.git%{shortcommit0}%{?dist} +Release: 1.git%{shortcommit0}%{?dist}.2 License: GPL-2.0-or-later URL: https://github.com/open-iscsi/open-iscsi Source0: https://github.com/open-iscsi/open-iscsi/archive/%{commit0}.tar.gz#/open-iscsi-%{shortcommit0}.tar.gz Source4: 04-iscsi Source5: iscsi-tmpfiles.conf -Patch01: 0001-meson-don-t-hide-things-with-Wno-all.patch +Patch00: 0001-meson-don-t-hide-things-with-Wno-all.patch + +# https://github.com/open-iscsi/open-iscsi/commit/290d16d6c6b6f4c78af119eb874484b2f995dc23 +Patch01: 0001-Fix-incorrect-parsing-of-node.discovery_type-static-.patch # https://github.com/open-iscsi/open-iscsi/pull/394/ Patch02: 0002-Currently-when-iscsi.service-is-installed-it-creates.patch @@ -38,6 +41,11 @@ Patch102: 0102-libiscsi-introduce-sessions-API.patch Patch103: 0103-fix-libiscsi-firmware-discovery-issue-with-NULL-drec.patch Patch104: 0104-libiscsi-build-fixes.patch +# https://issues.redhat.com/browse/RHEL-219481 +# https://issues.redhat.com/browse/RHEL-219469 +# https://github.com/open-iscsi/open-iscsi/commit/668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e +Patch105: iscsi-initiator-utils-6.2.1.11-RHEL-219481.patch + BuildRequires: meson git BuildRequires: flex bison doxygen kmod-devel systemd-units BuildRequires: autoconf automake libtool libmount-devel openssl-devel @@ -271,6 +279,17 @@ systemctl --no-reload preset iscsi.service iscsi-starter.service &>/dev/null || %endif %changelog +* Thu Jul 30 2026 RHEL Packaging Agent - 6.2.1.11-1.git4b3e853.2 +- fix CVE-2026-44943: path traversal via IQN names in discovery +- fix CVE-2026-44944: iscsiuio socket credential verification bypass + +* Thu Jul 30 2026 RHEL Packaging Agent - 6.2.1.11-1.git4b3e853.1 +- fix CVE-2026-44943: path traversal via IQN names in discovery +- fix CVE-2026-44944: iscsiuio socket credential verification bypass + +* Thu Jun 25 2026 Chris Leech - 6.2.1.11-1.git4b3e853 +- fix regression in fw and static node records + * Wed May 07 2025 Chris Leech - 6.2.1.11-0.git4b3e853 - Open-iSCSI upstream 2.1.11