From 4e68f2eb961f2ec8ed8acb682de42cd67f73b824 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 11 Aug 2026 17:53:20 -0400 Subject: [PATCH] import UBI isns-utils-0.103-1.el10_2.1 --- isns-utils-0.103-CVE-2026-55995.patch | 36 ++++++++++++++++++++++++++ isns-utils.spec | 9 ++++++- test_as_installed.patch | 37 +++++++++++++++++++-------- 3 files changed, 71 insertions(+), 11 deletions(-) create mode 100644 isns-utils-0.103-CVE-2026-55995.patch diff --git a/isns-utils-0.103-CVE-2026-55995.patch b/isns-utils-0.103-CVE-2026-55995.patch new file mode 100644 index 0000000..68597f2 --- /dev/null +++ b/isns-utils-0.103-CVE-2026-55995.patch @@ -0,0 +1,36 @@ +From 5271d61c641b387877c177e25a798cec44cdc0ba Mon Sep 17 00:00:00 2001 +From: Lee Duncan +Date: Tue, 28 Jul 2026 11:07:24 -0700 +Subject: [PATCH] Fix issue in error path causing double-free. + +In attrs.c, when buf_get() fails and allocated memory is +freed, we also need to set the pointer to that memory to +NULL, to prevent a double free from occuring, would could +lead to a DoS attack. + +References: CVE-2026-55995 +Found-by: +--- + attrs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/attrs.c b/attrs.c +index a12c222..15c930d 100644 +--- a/attrs.c ++++ b/attrs.c +@@ -1371,6 +1371,7 @@ isns_attr_type_string_decode(buf_t *bp, size_t len, isns_value_t *value) + value->iv_string = isns_malloc(len + 1); + if (!buf_get(bp, value->iv_string, len)) { + isns_free(value->iv_string); ++ value->iv_string = NULL; + return 0; + } + value->iv_string[len] = '\0'; +@@ -1546,6 +1547,7 @@ isns_attr_type_opaque_decode(buf_t *bp, size_t len, isns_value_t *value) + value->iv_opaque.ptr = isns_malloc(len); + if (!buf_get(bp, value->iv_opaque.ptr, len)) { + isns_free(value->iv_opaque.ptr); ++ value->iv_opaque.ptr = NULL; + return 0; + } + diff --git a/isns-utils.spec b/isns-utils.spec index d5f2b47..f106b0d 100644 --- a/isns-utils.spec +++ b/isns-utils.spec @@ -1,6 +1,6 @@ Name: isns-utils Version: 0.103 -Release: 1%{?dist} +Release: 1%{?dist}.1 Summary: The iSNS daemon and utility programs License: LGPL-2.1-or-later @@ -8,6 +8,9 @@ URL: https://github.com/open-iscsi/open-isns Source0: https://github.com/open-iscsi/open-isns/archive/v%{version}.tar.gz#/open-isns-%{version}.tar.gz Source1: isnsd.service Patch1: test_as_installed.patch +# https://issues.redhat.com/browse/RHEL-219472 +# https://github.com/open-iscsi/open-isns/commit/56718d4e9d1a4f51c30697b5c0534144bb41c9bb +Patch2: isns-utils-0.103-CVE-2026-55995.patch BuildRequires: gcc BuildRequires: pkgconfig systemd-devel systemd @@ -104,6 +107,10 @@ install -p -m 644 %{SOURCE1} %{buildroot}%{_unitdir}/isnsd.service %changelog +* Thu Jul 30 2026 RHEL Packaging Agent - 0.103-1.1 +- Fix double-free vulnerability in attrs.c error paths (CVE-2026-55995) + Resolves: RHEL-219472 + * Fri Dec 13 2024 Chris Leech - 0.101-12 - Add explicit requires with version on subpackage isns-utils-lib Resolves: RHEL-70744 diff --git a/test_as_installed.patch b/test_as_installed.patch index 372a4e2..768df9a 100644 --- a/test_as_installed.patch +++ b/test_as_installed.patch @@ -1,4 +1,4 @@ -From f04f3c56ac1598a787cee58489e3de5589d7f879 Mon Sep 17 00:00:00 2001 +From 041cf864d4c776b13fb04be5b7fa4958123d496e Mon Sep 17 00:00:00 2001 From: Chris Leech Date: Fri, 13 Dec 2024 20:48:21 -0800 Subject: [PATCH 1/1] Test from installed for CI @@ -6,13 +6,13 @@ Subject: [PATCH 1/1] Test from installed for CI Signed-off-by: Chris Leech --- tests/Makefile | 5 +++++ - tests/harness.py | 6 ++++++ - 2 files changed, 11 insertions(+) + tests/harness.py | 9 ++++++++- + 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 tests/Makefile diff --git a/tests/Makefile b/tests/Makefile new file mode 100644 -index 0000000..cd856c2 +index 0000000..fdd79ac --- /dev/null +++ b/tests/Makefile @@ -0,0 +1,5 @@ @@ -20,12 +20,20 @@ index 0000000..cd856c2 +# Excludes tests that use external test binaries (8-11) +tests-as-installed: + @echo running tests from installed executables -+ ./test-isns.py --bin-dir=/usr/sbin Test0{1..7} ++ ./test-isns.py --bin-dir=/usr/sbin diff --git a/tests/harness.py b/tests/harness.py -index f232132..d5a03b1 100644 +index f232132..6f3759a 100644 --- a/tests/harness.py +++ b/tests/harness.py -@@ -60,6 +60,8 @@ def get_bindir(): +@@ -8,6 +8,7 @@ import sys + import unittest + import re + import time ++from pathlib import Path + + # + # globals +@@ -60,6 +61,8 @@ def get_bindir(): """ return the directory where binaries live """ @@ -34,7 +42,7 @@ index f232132..d5a03b1 100644 return '%s/%s' % (Global.test_dir, Global.isns_bin_dir) def isns_stage(name, msg): -@@ -148,6 +150,9 @@ def new_initArgParsers(self): +@@ -148,6 +151,9 @@ def new_initArgParsers(self): self._main_parser.add_argument('-D', '--test-dir', dest='test_dir', default='.', help='Sets the test dir (default ".")') @@ -44,7 +52,7 @@ index f232132..d5a03b1 100644 def new_parseArgs(self, argv): """ -@@ -160,6 +165,7 @@ def new_parseArgs(self, argv): +@@ -160,6 +166,7 @@ def new_parseArgs(self, argv): Global.security = self.security Global.debug = self.debug Global.test_dir = self.test_dir @@ -52,6 +60,15 @@ index f232132..d5a03b1 100644 dprint("found: debug=%s, verbosity=%d, security=%s, list=%s, test_dir='%s'" % \ (Global.debug, Global.verbosity, Global.security, self.list, self.test_dir)) +@@ -432,7 +439,7 @@ def isns_external_test(client_config, args): + """ + logfile = get_logfile_from_config(client_config.path) + +- cmd = ['%s/%s' % (get_bindir(), args[0]), ++ cmd = ['%s/%s/%s' % (Path(__file__).resolve().parent.parent, "builddir", args[0]), + '-c', client_config.path] + args[1:] + exit_val = run_cmd(cmd, logfile) + return (logfile, exit_val) -- -2.47.0 +2.55.0