From cfeec9026bd0d2f62ff639bd7ccc44ad531e5321 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Thu, 30 Jul 2026 09:01:36 +0000 Subject: [PATCH] Fix CVE-2026-55995: double-free in isns-utils attrs.c error paths Backport upstream fix for CVE-2026-55995 to isns-utils. The patch adds NULL pointer assignments after isns_free() calls in two error paths in attrs.c (isns_attr_type_string_decode and isns_attr_type_opaque_decode) to prevent double-free vulnerabilities that could lead to denial-of-service attacks. CVE: CVE-2026-55995 Upstream patches: - https://github.com/open-iscsi/open-isns/commit/56718d4e9d1a4f51c30697b5c0534144bb41c9bb.patch Resolves: RHEL-219474 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- isns-utils-0.99-CVE-2026-55995.patch | 36 ++++++++++++++++++++++++++++ isns-utils.spec | 9 ++++++- 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 isns-utils-0.99-CVE-2026-55995.patch diff --git a/isns-utils-0.99-CVE-2026-55995.patch b/isns-utils-0.99-CVE-2026-55995.patch new file mode 100644 index 0000000..ecfa072 --- /dev/null +++ b/isns-utils-0.99-CVE-2026-55995.patch @@ -0,0 +1,36 @@ +From 555de0527371cbcc4a94d177b64483898a29c828 Mon Sep 17 00:00:00 2001 +From: Lee Duncan +Date: Tue, 28 Jul 2026 11:07:24 -0700 +Subject: [PATCH] Fix issue in error path causing double-free. + +In attrs.c, when buf_get() fails and allocated memory is +freed, we also need to set the pointer to that memory to +NULL, to prevent a double free from occuring, would could +lead to a DoS attack. + +References: CVE-2026-55995 +Found-by: +--- + attrs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/attrs.c b/attrs.c +index ac9b524..1b3b074 100644 +--- a/attrs.c ++++ b/attrs.c +@@ -1366,6 +1366,7 @@ isns_attr_type_string_decode(buf_t *bp, size_t len, isns_value_t *value) + value->iv_string = isns_malloc(len + 1); + if (!buf_get(bp, value->iv_string, len)) { + isns_free(value->iv_string); ++ value->iv_string = NULL; + return 0; + } + value->iv_string[len] = '\0'; +@@ -1541,6 +1542,7 @@ isns_attr_type_opaque_decode(buf_t *bp, size_t len, isns_value_t *value) + value->iv_opaque.ptr = isns_malloc(len); + if (!buf_get(bp, value->iv_opaque.ptr, len)) { + isns_free(value->iv_opaque.ptr); ++ value->iv_opaque.ptr = NULL; + return 0; + } + diff --git a/isns-utils.spec b/isns-utils.spec index 253995d..5f5a274 100644 --- a/isns-utils.spec +++ b/isns-utils.spec @@ -1,6 +1,6 @@ Name: isns-utils Version: 0.99 -Release: 1%{?dist} +Release: 1%{?dist}.1 Summary: The iSNS daemon and utility programs Group: System Environment/Daemons @@ -9,11 +9,15 @@ URL: https://github.com/open-iscsi/open-isns Source0: https://github.com/open-iscsi/open-isns/archive/v%{version}.tar.gz#/open-isns-%{version}.tar.gz Patch1: fix-openssl-argument-order-in-tests.patch Patch2: test_as_installed.patch +# https://issues.redhat.com/browse/RHEL-219474 +# https://github.com/open-iscsi/open-isns/commit/56718d4e9d1a4f51c30697b5c0534144bb41c9bb +Patch3: isns-utils-0.99-CVE-2026-55995.patch BuildRequires: openssl-devel automake pkgconfig systemd-devel systemd Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units +Requires: %{name}-libs%{?_isa} = %{version}-%{release} %description @@ -109,6 +113,9 @@ chmod 755 %{buildroot}%{_libdir}/libisns.so.0 %changelog +* Thu Jul 30 2026 RHEL Packaging Agent - 0.99-1.1 +- Fix double-free vulnerabilities in attrs.c error paths (CVE-2026-55995) + * Fri Mar 22 2019 Chris Leech - 0.99-1 - rebase to 0.99