From 9092d2647aae081ffe6611a0e75b3ddd1161433e Mon Sep 17 00:00:00 2001 From: Josef Ridky Date: Mon, 10 Nov 2025 11:16:57 +0100 Subject: [PATCH] Resolves: RHEL-121405 - fix use after free issue Signed-off-by: Josef Ridky --- net-snmp-5.8-callback-fix.patch | 32 ++++++++++++++++++++++++++++++++ net-snmp.spec | 7 ++++++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 net-snmp-5.8-callback-fix.patch diff --git a/net-snmp-5.8-callback-fix.patch b/net-snmp-5.8-callback-fix.patch new file mode 100644 index 0000000..d82a41f --- /dev/null +++ b/net-snmp-5.8-callback-fix.patch @@ -0,0 +1,32 @@ +diff -urNp a/snmplib/callback.c b/snmplib/callback.c +--- a/snmplib/callback.c 2025-08-13 15:21:25.507544080 +0200 ++++ b/snmplib/callback.c 2025-08-13 15:25:01.973092935 +0200 +@@ -346,13 +346,17 @@ snmp_call_callbacks(int major, int minor + /* + * for each registered callback of type major and minor + */ +- for (scp = thecallbacks[major][minor]; scp != NULL; scp = scp->next) { ++ scp = thecallbacks[major][minor]; ++ while (scp != NULL) { ++ struct snmp_gen_callback *scp_next = scp->next; + + /* + * skip unregistered callbacks + */ +- if(NULL == scp->sc_callback) ++ if(NULL == scp->sc_callback) { ++ scp = scp_next; + continue; ++ } + + DEBUGMSGTL(("callback", "calling a callback for maj=%d min=%d\n", + major, minor)); +@@ -363,6 +367,8 @@ snmp_call_callbacks(int major, int minor + (*(scp->sc_callback)) (major, minor, caller_arg, + scp->sc_client_arg); + count++; ++ ++ scp = scp_next; + } + + DEBUGMSGTL(("callback", diff --git a/net-snmp.spec b/net-snmp.spec index 70e67ee..5d92048 100644 --- a/net-snmp.spec +++ b/net-snmp.spec @@ -10,7 +10,7 @@ Summary: A collection of SNMP protocol tools and libraries Name: net-snmp Version: 5.9.4 -Release: 16%{?dist} +Release: 17%{?dist} Epoch: 1 License: MIT-CMU and BSD-3-Clause and MIT and OpenSSL @@ -55,6 +55,7 @@ Patch25: net-snmp-5.9.4-kernel-6.7.patch Patch26: net-snmp-5.9.4-remove-mail-sender.patch Patch27: net-snmp-5.9.4-tls.patch Patch28: net-snmp-5.9.4-revert-n-snmptrapd-log.patch +Patch29: net-snmp-5.8-callback-fix.patch # Modern RPM API means at least EL6 Patch101: net-snmp-5.8-modern-rpm-api.patch @@ -249,6 +250,7 @@ cp %{SOURCE10} . %patch 26 -p1 -b .remove-mail-sender %patch 27 -p1 -b .tls %patch 28 -p1 -b .revert-n-snmptrapd-log +%patch 29 -p1 -b .callback-fix %patch 101 -p1 -b .modern-rpm-api %patch 102 -p1 @@ -519,6 +521,9 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test %{_libdir}/libnetsnmptrapd*.so.%{soname}* %changelog +* Mon Nov 10 2025 Josef Ridky - 1:5.9.4-17 +- fix use after free issue (RHEL-121405) + * Wed Sep 03 2025 Josef Ridky - 1:5.9.4-16 - Enable PQC in net-snmp (RHEL-93087) - Fix inverted use of -n in snmptrapd_log.c (RHEL-110514)