rpms/isns-utils
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-55995: double-free in isns-utils attrs.c error paths

Browse Source 
Backport upstream fix for CVE-2026-55995 to isns-utils.
The patch adds NULL pointer assignments after isns_free()
calls in two error paths in attrs.c
(isns_attr_type_string_decode and isns_attr_type_opaque_decode)
to prevent double-free vulnerabilities that could lead to
denial-of-service attacks.

CVE: CVE-2026-55995
Upstream patches:
 - 56718d4e9d.patch
Resolves: RHEL-219474

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-30 09:01:36 +00:00 committed by Chris Leech
parent 161cd9466f
commit cfeec9026b
2 changed files with 44 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
isns-utils-0.99-CVE-2026-55995.patch Normal file
View File

@ -0,0 +1,36 @@
From 555de0527371cbcc4a94d177b64483898a29c828 Mon Sep 17 00:00:00 2001
From: Lee Duncan <lduncan@suse.com>
Date: Tue, 28 Jul 2026 11:07:24 -0700
Subject: [PATCH] Fix issue in error path causing double-free.
In attrs.c, when buf_get() fails and allocated memory is
freed, we also need to set the pointer to that memory to
NULL, to prevent a double free from occuring, would could
lead to a DoS attack.
References: CVE-2026-55995
Found-by: <keith@linnemanlabs.com>
---
attrs.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/attrs.c b/attrs.c
index ac9b524..1b3b074 100644
--- a/attrs.c
+++ b/attrs.c
@@ -1366,6 +1366,7 @@ isns_attr_type_string_decode(buf_t *bp, size_t len, isns_value_t *value)
value->iv_string = isns_malloc(len + 1);
if (!buf_get(bp, value->iv_string, len)) {
isns_free(value->iv_string);
+ value->iv_string = NULL;
return 0;
}
value->iv_string[len] = '\0';
@@ -1541,6 +1542,7 @@ isns_attr_type_opaque_decode(buf_t *bp, size_t len, isns_value_t *value)
value->iv_opaque.ptr = isns_malloc(len);
if (!buf_get(bp, value->iv_opaque.ptr, len)) {
isns_free(value->iv_opaque.ptr);
+ value->iv_opaque.ptr = NULL;
return 0;
}

9
isns-utils.spec
View File

@ -1,6 +1,6 @@
Name: isns-utils
Version: 0.99
Release: 1%{?dist}
Release: 1%{?dist}.1
Summary: The iSNS daemon and utility programs
Group: System Environment/Daemons
@ -9,11 +9,15 @@ URL: https://github.com/open-iscsi/open-isns
Source0: https://github.com/open-iscsi/open-isns/archive/v%{version}.tar.gz#/open-isns-%{version}.tar.gz
Patch1: fix-openssl-argument-order-in-tests.patch
Patch2: test_as_installed.patch
# https://issues.redhat.com/browse/RHEL-219474
# https://github.com/open-iscsi/open-isns/commit/56718d4e9d1a4f51c30697b5c0534144bb41c9bb
Patch3: isns-utils-0.99-CVE-2026-55995.patch
BuildRequires: openssl-devel automake pkgconfig systemd-devel systemd
Requires(post): systemd-units
Requires(preun): systemd-units
Requires(postun): systemd-units
Requires: %{name}-libs%{?_isa} = %{version}-%{release}
%description
@ -109,6 +113,9 @@ chmod 755 %{buildroot}%{_libdir}/libisns.so.0
%changelog
* Thu Jul 30 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 0.99-1.1
- Fix double-free vulnerabilities in attrs.c error paths (CVE-2026-55995)
* Fri Mar 22 2019 Chris Leech <cleech@redhat.com> - 0.99-1
- rebase to 0.99