CVE-2026-55995: 
CBL Mariner 취약성 분석 및 완화

CVE-2026-55995 is a Double Free vulnerability in open-iscsi (specifically the open-isns component) that allows an unauthenticated man-in-the-middle (MITM) attacker to cause a Denial of Service (DoS). The vulnerability affects open-iscsi versions up to and including commit 56718d4e9d1a4f51c30697b5c0534144bb41c9bb. It was published on July 29, 2026, with a patch committed the same day. The vulnerability carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a double free memory corruption flaw (CWE-415 / CWE-763) in the iSNS attribute decoder within attrs.c of the open-isns library. Specifically, in the isns_attr_type_string_decode() and isns_attr_type_opaque_decode() functions, when buf_get() fails during attribute parsing, allocated memory is freed via isns_free() but the pointer is not subsequently set to NULL. This leaves a dangling pointer that can be freed again later, triggering a double free condition. An attacker positioned as a MITM on the network can send crafted iSNS protocol messages that trigger the error path, causing the double free and crashing the open-iscsi service. No authentication or user interaction is required (GitHub Commit, Red Hat Bugzilla).

Successful exploitation results in a crash of the open-iscsi service, causing a Denial of Service condition that makes iSCSI storage targets unavailable to legitimate users and systems. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. In environments where iSCSI is used for critical storage (e.g., SAN-attached storage in enterprise or virtualization infrastructure), a service crash could disrupt storage access for multiple dependent systems, potentially causing broader outages (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit or evidence of active in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.25% (17th percentile), indicating a low near-term probability of exploitation. However, the attack is automatable and requires no privileges or user interaction, only a MITM network position, which lowers the practical barrier for exploitation in poorly segmented networks.

1. Gain MITM Position: Position on the network path between an open-iscsi initiator and the iSNS server, using techniques such as ARP spoofing, rogue DHCP, or compromising a network device on the same segment.
2. Intercept iSNS Traffic: Capture and inspect iSNS protocol traffic (typically over TCP port 3205) between the initiator and the iSNS discovery server.
3. Craft Malicious iSNS Attribute: Construct a malformed iSNS response message containing a string or opaque attribute whose buf_get() call will fail during decoding — for example, by specifying a length that exceeds the available buffer data.
4. Inject Malicious Response: Inject the crafted iSNS response into the communication stream in place of or in addition to the legitimate server response.
5. Trigger Double Free: The open-isns attribute decoder processes the malformed attribute, buf_get() fails, the pointer is freed but not nulled, and a subsequent free of the same pointer triggers the double free, crashing the open-iscsi service and causing a DoS (GitHub Commit, Red Hat Bugzilla).

• Network: Unexpected or malformed iSNS protocol messages on TCP port 3205; ARP spoofing or unusual ARP table entries on the iSCSI network segment; unexpected traffic between iSCSI initiators and unknown hosts posing as iSNS servers.
• Logs: Repeated crashes or restarts of the iscsid or open-isns daemon in system logs (/var/log/syslog, /var/log/messages, or journalctl); segmentation fault or abort signals attributed to the open-iscsi process.
• Process: Unexpected termination of iscsid or related open-iscsi processes; core dump files generated in the working directory of the open-iscsi service.
• File System: Presence of core dump files (e.g., core, core.<pid>) in directories associated with the open-iscsi service.

The vulnerability is fixed by the commit 56718d4e9d1a4f51c30697b5c0534144bb41c9bb in the open-isns repository, which sets freed pointers to NULL in the error paths of isns_attr_type_string_decode() and isns_attr_type_opaque_decode() (GitHub Commit). Users should update open-iscsi/open-isns to a version incorporating this patch. As a network-level workaround, implement strict network segmentation to restrict who can intercept or inject iSNS traffic, and consider enabling iSCSI with CHAP authentication and TLS to prevent unauthorized traffic manipulation. Monitor vendor distributions (Red Hat, SUSE, etc.) for downstream package updates (Red Hat Bugzilla, GitHub Advisory).

The vulnerability was reported via SUSE's Bugzilla and tracked by Red Hat's Product Security team shortly after disclosure on July 29, 2026. No notable public researcher commentary, social media discussion, or significant media coverage has been identified beyond standard vulnerability database aggregation (Red Hat Bugzilla, GitHub Advisory).