cfeec9026b
Backport upstream fix for CVE-2026-55995 to isns-utils.
The patch adds NULL pointer assignments after isns_free()
calls in two error paths in attrs.c
(isns_attr_type_string_decode and isns_attr_type_opaque_decode)
to prevent double-free vulnerabilities that could lead to
denial-of-service attacks.
CVE: CVE-2026-55995
Upstream patches:
- 56718d4e9d.patch
Resolves: RHEL-219474
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
37 lines
1.1 KiB
Diff
37 lines
1.1 KiB
Diff
From 555de0527371cbcc4a94d177b64483898a29c828 Mon Sep 17 00:00:00 2001
|
|
From: Lee Duncan <lduncan@suse.com>
|
|
Date: Tue, 28 Jul 2026 11:07:24 -0700
|
|
Subject: [PATCH] Fix issue in error path causing double-free.
|
|
|
|
In attrs.c, when buf_get() fails and allocated memory is
|
|
freed, we also need to set the pointer to that memory to
|
|
NULL, to prevent a double free from occuring, would could
|
|
lead to a DoS attack.
|
|
|
|
References: CVE-2026-55995
|
|
Found-by: <keith@linnemanlabs.com>
|
|
---
|
|
attrs.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/attrs.c b/attrs.c
|
|
index ac9b524..1b3b074 100644
|
|
--- a/attrs.c
|
|
+++ b/attrs.c
|
|
@@ -1366,6 +1366,7 @@ isns_attr_type_string_decode(buf_t *bp, size_t len, isns_value_t *value)
|
|
value->iv_string = isns_malloc(len + 1);
|
|
if (!buf_get(bp, value->iv_string, len)) {
|
|
isns_free(value->iv_string);
|
|
+ value->iv_string = NULL;
|
|
return 0;
|
|
}
|
|
value->iv_string[len] = '\0';
|
|
@@ -1541,6 +1542,7 @@ isns_attr_type_opaque_decode(buf_t *bp, size_t len, isns_value_t *value)
|
|
value->iv_opaque.ptr = isns_malloc(len);
|
|
if (!buf_get(bp, value->iv_opaque.ptr, len)) {
|
|
isns_free(value->iv_opaque.ptr);
|
|
+ value->iv_opaque.ptr = NULL;
|
|
return 0;
|
|
}
|
|
|