Skip to content

[AutoPR- Security] Patch isns-utils for CVE-2026-55995 [HIGH] #18320

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
azurelinux-security wants to merge 1 commit into
base: fasttrack/3.0
Choose a base branch
from
+46 −1
Open

[AutoPR- Security] Patch isns-utils for CVE-2026-55995 [HIGH] #18320

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions SPECS/isns-utils/CVE-2026-55995.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
From 1ce83dd769eeab83ea4aeadf074b6f643b3adf96 Mon Sep 17 00:00:00 2001
From: Lee Duncan <lduncan@suse.com>
Date: Tue, 28 Jul 2026 11:07:24 -0700
Subject: [PATCH] Fix issue in error path causing double-free.

In attrs.c, when buf_get() fails and allocated memory is
freed, we also need to set the pointer to that memory to
NULL, to prevent a double free from occuring, would could
lead to a DoS attack.

References: CVE-2026-55995
Found-by: <keith@linnemanlabs.com>
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Upstream-reference: https://github.com/open-iscsi/open-isns/commit/56718d4e9d1a4f51c30697b5c0534144bb41c9bb.patch
---
attrs.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/attrs.c b/attrs.c
index 44d9675..8e48170 100644
--- a/attrs.c
+++ b/attrs.c
@@ -1371,6 +1371,7 @@ isns_attr_type_string_decode(buf_t *bp, size_t len, isns_value_t *value)
value->iv_string = isns_malloc(len + 1);
if (!buf_get(bp, value->iv_string, len)) {
isns_free(value->iv_string);
+ value->iv_string = NULL;
return 0;
}
value->iv_string[len] = '\0';
@@ -1546,6 +1547,7 @@ isns_attr_type_opaque_decode(buf_t *bp, size_t len, isns_value_t *value)
value->iv_opaque.ptr = isns_malloc(len);
if (!buf_get(bp, value->iv_opaque.ptr, len)) {
isns_free(value->iv_opaque.ptr);
+ value->iv_opaque.ptr = NULL;
return 0;
}

--
2.45.4

6 changes: 5 additions & 1 deletion SPECS/isns-utils/isns-utils.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,14 @@
Summary: The iSNS daemon and utility programs
Name: isns-utils
Version: 0.102
Release: 1%{?dist}
Release: 2%{?dist}
License: LGPLv2+
Vendor: Microsoft Corporation
Distribution: Azure Linux
URL: https://github.com/open-iscsi/open-isns
Source0: https://github.com/open-iscsi/open-isns/archive/v%{version}.tar.gz#/open-isns-%{version}.tar.gz
Source1: isnsd.service
Patch0: CVE-2026-55995.patch

BuildRequires: automake
BuildRequires: gcc
Expand Down Expand Up @@ -101,6 +102,9 @@ install -p -m 644 %{SOURCE1} %{buildroot}%{_unitdir}/isnsd.service
%{_libdir}/pkgconfig/libisns.pc

%changelog
* Wed Aug 05 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 0.102-2
- Patch for CVE-2026-55995

* Tue Jan 16 2024 Brian Fjeldstad <bfjelds@microsoft.com> - 0.102-1
- Update source to v0.102

Expand Down
Loading