rpms/isns-utils
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-55995: double-free in isns-utils attrs.c error paths

Browse Source 
Backport upstream fix for CVE-2026-55995, a double-free
vulnerability in attrs.c. The patch sets freed pointers to
NULL in the error paths of isns_attr_type_string_decode and
isns_attr_type_opaque_decode to prevent double-free conditions
that could lead to denial of service.

CVE: CVE-2026-55995
Upstream patches:
 - 56718d4e9d.patch
Resolves: RHEL-219462

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-11 21:50:31 +00:00 committed by Chris Leech
parent e5c6fbfb6d
commit ffc0b3870c
2 changed files with 42 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
isns-utils-0.101-CVE-2026-55995.patch Normal file
View File

@ -0,0 +1,36 @@
From 21e61d675ca8e4637b3a0a7f19adf3cb3f77e422 Mon Sep 17 00:00:00 2001
From: Lee Duncan <lduncan@suse.com>
Date: Tue, 28 Jul 2026 11:07:24 -0700
Subject: [PATCH] Fix issue in error path causing double-free.
In attrs.c, when buf_get() fails and allocated memory is
freed, we also need to set the pointer to that memory to
NULL, to prevent a double free from occuring, would could
lead to a DoS attack.
References: CVE-2026-55995
Found-by: <keith@linnemanlabs.com>
---
attrs.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/attrs.c b/attrs.c
index 44d9675..8e48170 100644
--- a/attrs.c
+++ b/attrs.c
@@ -1371,6 +1371,7 @@ isns_attr_type_string_decode(buf_t *bp, size_t len, isns_value_t *value)
value->iv_string = isns_malloc(len + 1);
if (!buf_get(bp, value->iv_string, len)) {
isns_free(value->iv_string);
+ value->iv_string = NULL;
return 0;
}
value->iv_string[len] = '\0';
@@ -1546,6 +1547,7 @@ isns_attr_type_opaque_decode(buf_t *bp, size_t len, isns_value_t *value)
value->iv_opaque.ptr = isns_malloc(len);
if (!buf_get(bp, value->iv_opaque.ptr, len)) {
isns_free(value->iv_opaque.ptr);
+ value->iv_opaque.ptr = NULL;
return 0;
}

7
isns-utils.spec
View File

@ -1,6 +1,6 @@
Name: isns-utils
Version: 0.101
Release: 4%{?dist}
Release: 5%{?dist}
Summary: The iSNS daemon and utility programs
License: LGPLv2+
@ -8,6 +8,8 @@ URL: https://github.com/open-iscsi/open-isns
Source0: https://github.com/open-iscsi/open-isns/archive/v%{version}.tar.gz#/open-isns-%{version}.tar.gz
Source1: isnsd.service
Patch1: test_as_installed.patch
# https://github.com/open-iscsi/open-isns/commit/56718d4e9d1a4f51c30697b5c0534144bb41c9bb
Patch2: isns-utils-0.101-CVE-2026-55995.patch
BuildRequires: gcc
BuildRequires: automake pkgconfig systemd-devel systemd
@ -105,6 +107,9 @@ install -p -m 644 %{SOURCE1} %{buildroot}%{_unitdir}/isnsd.service
%changelog
* Tue Aug 11 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 0.101-5
- Fix CVE-2026-55995: double-free in attrs.c error paths
* Tue Sep 14 2021 Chris Leech <cleech@redhat.com> - 0.101-4
- #1934951 remove DSA/SHA-1 based authentication support