From 4a18e413ca5a2e1013393f3a2cfb1bffdf11420e Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Wed, 5 Aug 2026 06:48:16 +0000 Subject: [PATCH] Patch isns-utils for CVE-2026-55995 --- SPECS/isns-utils/CVE-2026-55995.patch | 41 +++++++++++++++++++++++++++ SPECS/isns-utils/isns-utils.spec | 6 +++- 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 SPECS/isns-utils/CVE-2026-55995.patch diff --git a/SPECS/isns-utils/CVE-2026-55995.patch b/SPECS/isns-utils/CVE-2026-55995.patch new file mode 100644 index 00000000000..6101e3769b1 --- /dev/null +++ b/SPECS/isns-utils/CVE-2026-55995.patch @@ -0,0 +1,41 @@ +From 1ce83dd769eeab83ea4aeadf074b6f643b3adf96 Mon Sep 17 00:00:00 2001 +From: Lee Duncan +Date: Tue, 28 Jul 2026 11:07:24 -0700 +Subject: [PATCH] Fix issue in error path causing double-free. + +In attrs.c, when buf_get() fails and allocated memory is +freed, we also need to set the pointer to that memory to +NULL, to prevent a double free from occuring, would could +lead to a DoS attack. + +References: CVE-2026-55995 +Found-by: +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/open-iscsi/open-isns/commit/56718d4e9d1a4f51c30697b5c0534144bb41c9bb.patch +--- + attrs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/attrs.c b/attrs.c +index 44d9675..8e48170 100644 +--- a/attrs.c ++++ b/attrs.c +@@ -1371,6 +1371,7 @@ isns_attr_type_string_decode(buf_t *bp, size_t len, isns_value_t *value) + value->iv_string = isns_malloc(len + 1); + if (!buf_get(bp, value->iv_string, len)) { + isns_free(value->iv_string); ++ value->iv_string = NULL; + return 0; + } + value->iv_string[len] = '\0'; +@@ -1546,6 +1547,7 @@ isns_attr_type_opaque_decode(buf_t *bp, size_t len, isns_value_t *value) + value->iv_opaque.ptr = isns_malloc(len); + if (!buf_get(bp, value->iv_opaque.ptr, len)) { + isns_free(value->iv_opaque.ptr); ++ value->iv_opaque.ptr = NULL; + return 0; + } + +-- +2.45.4 + diff --git a/SPECS/isns-utils/isns-utils.spec b/SPECS/isns-utils/isns-utils.spec index d9666234ae3..0e4104d8be7 100644 --- a/SPECS/isns-utils/isns-utils.spec +++ b/SPECS/isns-utils/isns-utils.spec @@ -1,13 +1,14 @@ Summary: The iSNS daemon and utility programs Name: isns-utils Version: 0.102 -Release: 1%{?dist} +Release: 2%{?dist} License: LGPLv2+ Vendor: Microsoft Corporation Distribution: Azure Linux URL: https://github.com/open-iscsi/open-isns Source0: https://github.com/open-iscsi/open-isns/archive/v%{version}.tar.gz#/open-isns-%{version}.tar.gz Source1: isnsd.service +Patch0: CVE-2026-55995.patch BuildRequires: automake BuildRequires: gcc @@ -101,6 +102,9 @@ install -p -m 644 %{SOURCE1} %{buildroot}%{_unitdir}/isnsd.service %{_libdir}/pkgconfig/libisns.pc %changelog +* Wed Aug 05 2026 Azure Linux Security Servicing Account - 0.102-2 +- Patch for CVE-2026-55995 + * Tue Jan 16 2024 Brian Fjeldstad - 0.102-1 - Update source to v0.102