From 48ccfe833ac249cb393ea06de0b93ec9b2dd1ceb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 4 Feb 2025 14:32:45 +0100 Subject: [PATCH] Limit the additional processing for large RDATA sets When answering queries, don't add data to the additional section if the answer has more than 13 names in the RDATA. This limits the number of lookups into the database(s) during a single client query, reducing query processing load. Also, don't append any additional data to type=ANY queries. The answer to ANY is already big enough. Vulnerability: CVE-2024-11187 Resolves: RHEL-76875 (cherry picked from commit 90a94b1099913c2c18188f78a5226d43bc7fecc5) --- bind-9.18-CVE-2024-11187-pre-test.patch | 85 +++++++++++++ bind-9.18-CVE-2024-11187.patch | 151 ++++++++++++++++++++++++ bind.spec | 11 +- 3 files changed, 246 insertions(+), 1 deletion(-) create mode 100644 bind-9.18-CVE-2024-11187-pre-test.patch create mode 100644 bind-9.18-CVE-2024-11187.patch diff --git a/bind-9.18-CVE-2024-11187-pre-test.patch b/bind-9.18-CVE-2024-11187-pre-test.patch new file mode 100644 index 0000000..aa0476f --- /dev/null +++ b/bind-9.18-CVE-2024-11187-pre-test.patch @@ -0,0 +1,85 @@ +From 8a9b9ff5a8b2443f7df4f60397ad215931ba44f1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= +Date: Tue, 7 Jan 2025 15:22:40 +0100 +Subject: [PATCH] Isolate using the -T noaa flag only for part of the resolver + test + +Instead of running the whole resolver/ns4 server with -T noaa flag, +use it only for the part where it is actually needed. The -T noaa +could interfere with other parts of the test because the answers don't +have the authoritative-answer bit set, and we could have false +positives (or false negatives) in the test because the authoritative +server doesn't follow the DNS protocol for all the tests in the resolver +system test. + +(cherry picked from commit e51d4d3b88af00d6667f2055087ebfc47fb3107c) +--- + bin/tests/system/conf.sh.in | 12 ++++++++++++ + bin/tests/system/resolver/ns4/named.noaa | 5 ----- + bin/tests/system/resolver/tests.sh | 8 ++++++++ + 3 files changed, 20 insertions(+), 5 deletions(-) + delete mode 100644 bin/tests/system/resolver/ns4/named.noaa + +diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in +index 06852f5..f77f7de 100644 +--- a/bin/tests/system/conf.sh.in ++++ b/bin/tests/system/conf.sh.in +@@ -305,6 +305,18 @@ digcomp() { + return $result + } + ++start_server() { ++ $PERL "$SYSTEMTESTTOP/start.pl" "$SYSTESTDIR" "$@" ++} ++ ++stop_server() { ++ $PERL "$SYSTEMTESTTOP/stop.pl" "$SYSTESTDIR" "$@" ++} ++ ++send() { ++ $PERL "$SYSTEMTESTTOP/send.pl" "$@" ++} ++ + # + # Useful functions in test scripts + # +diff --git a/bin/tests/system/resolver/ns4/named.noaa b/bin/tests/system/resolver/ns4/named.noaa +deleted file mode 100644 +index 3b121ad..0000000 +--- a/bin/tests/system/resolver/ns4/named.noaa ++++ /dev/null +@@ -1,5 +0,0 @@ +-Copyright (C) Internet Systems Consortium, Inc. ("ISC") +- +-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms. +- +-Add -T noaa. +diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh +index 6eb52fe..bf37467 100755 +--- a/bin/tests/system/resolver/tests.sh ++++ b/bin/tests/system/resolver/tests.sh +@@ -281,6 +281,10 @@ done + if [ $ret != 0 ]; then echo_i "failed"; fi + status=`expr $status + $ret` + ++stop_server ns4 ++touch ns4/named.noaa ++start_server --noclean --restart --port ${PORT} ns4 || ret=1 ++ + n=`expr $n + 1` + echo_i "RT21594 regression test check setup ($n)" + ret=0 +@@ -317,6 +321,10 @@ grep "status: NXDOMAIN" dig.ns5.out.${n} > /dev/null || ret=1 + if [ $ret != 0 ]; then echo_i "failed"; fi + status=`expr $status + $ret` + ++stop_server ns4 ++rm ns4/named.noaa ++start_server --noclean --restart --port ${PORT} ns4 || ret=1 ++ + n=`expr $n + 1` + echo_i "check that replacement of additional data by a negative cache no data entry clears the additional RRSIGs ($n)" + ret=0 +-- +2.48.1 + diff --git a/bind-9.18-CVE-2024-11187.patch b/bind-9.18-CVE-2024-11187.patch new file mode 100644 index 0000000..8ccfe06 --- /dev/null +++ b/bind-9.18-CVE-2024-11187.patch @@ -0,0 +1,151 @@ +From ca6c3446ef07d89fd3a28b6979d947af2ab5754f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= +Date: Thu, 14 Nov 2024 10:37:29 +0100 +Subject: [PATCH] Limit the additional processing for large RDATA sets + +When answering queries, don't add data to the additional section if +the answer has more than 13 names in the RDATA. This limits the +number of lookups into the database(s) during a single client query, +reducing query processing load. + +Also, don't append any additional data to type=ANY queries. The +answer to ANY is already big enough. + +(cherry picked from commit a1982cf1bb95c818aa7b58988b5611dec80f2408) +PatchNumber: 47 +--- + bin/named/query.c | 14 ++++++++------ + bin/tests/system/additional/tests.sh | 2 +- + lib/dns/include/dns/rdataset.h | 12 ++++++++++++ + lib/dns/rdataset.c | 12 ++++++++++++ + 4 files changed, 33 insertions(+), 7 deletions(-) + +diff --git a/bin/named/query.c b/bin/named/query.c +index 51a29a8..e023d74 100644 +--- a/bin/named/query.c ++++ b/bin/named/query.c +@@ -1835,9 +1835,10 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) { + * section, it's helpful if we add the SRV additional data + * as well. + */ +- eresult = dns_rdataset_additionaldata(trdataset, +- query_addadditional, +- client); ++ eresult = dns_rdataset_additionaldata2(trdataset, ++ query_addadditional, ++ client, ++ DNS_RDATASET_MAXADDITIONAL); + } + + cleanup: +@@ -2432,7 +2433,7 @@ query_addrdataset(ns_client_t *client, dns_name_t *fname, + rdataset->rdclass); + rdataset->attributes |= DNS_RDATASETATTR_LOADORDER; + +- if (NOADDITIONAL(client)) ++ if (NOADDITIONAL(client) || client->query.qtype == dns_rdatatype_any) + return; + + /* +@@ -2442,8 +2443,9 @@ query_addrdataset(ns_client_t *client, dns_name_t *fname, + */ + additionalctx.client = client; + additionalctx.rdataset = rdataset; +- (void)dns_rdataset_additionaldata(rdataset, query_addadditional2, +- &additionalctx); ++ (void)dns_rdataset_additionaldata2(rdataset, query_addadditional2, ++ &additionalctx, ++ DNS_RDATASET_MAXADDITIONAL); + CTRACE(ISC_LOG_DEBUG(3), "query_addrdataset: done"); + } + +diff --git a/bin/tests/system/additional/tests.sh b/bin/tests/system/additional/tests.sh +index 6400723..a33cc8a 100644 +--- a/bin/tests/system/additional/tests.sh ++++ b/bin/tests/system/additional/tests.sh +@@ -261,7 +261,7 @@ n=`expr $n + 1` + echo_i "testing with 'minimal-any no;' ($n)" + ret=0 + $DIG $DIGOPTS -t ANY www.rt.example @10.53.0.1 > dig.out.$n || ret=1 +-grep "ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2" dig.out.$n > /dev/null || ret=1 ++grep "ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 1" dig.out.$n > /dev/null || ret=1 + if [ $ret -eq 1 ] ; then + echo_i "failed"; status=`expr status + 1` + fi +diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h +index 710e97c..b3532f6 100644 +--- a/lib/dns/include/dns/rdataset.h ++++ b/lib/dns/include/dns/rdataset.h +@@ -53,6 +53,8 @@ + #include + #include + ++#define DNS_RDATASET_MAXADDITIONAL 13 ++ + ISC_LANG_BEGINDECLS + + typedef enum { +@@ -501,13 +503,23 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset, + *\li If a call to dns_rdata_additionaldata() is not successful, the + * result returned will be the result of dns_rdataset_additionaldata(). + * ++ *\li If 'limit' is non-zero and the number of the rdatasets is larger ++ * than 'limit', no additional data will be processed. ++ * + * Returns: + * + *\li #ISC_R_SUCCESS + * ++ *\li #DNS_R_TOOMANYRECORDS in case rdataset count is larger than 'limit' ++ * + *\li Any error that dns_rdata_additionaldata() can return. + */ + ++isc_result_t ++dns_rdataset_additionaldata2(dns_rdataset_t *rdataset, ++ dns_additionaldatafunc_t add, void *arg, ++ size_t limit); ++ + isc_result_t + dns_rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name, + dns_rdataset_t *neg, dns_rdataset_t *negsig); +diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c +index b42dea5..5160acf 100644 +--- a/lib/dns/rdataset.c ++++ b/lib/dns/rdataset.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + + static const char *trustnames[] = { + "none", +@@ -608,6 +609,13 @@ dns_rdataset_towire(dns_rdataset_t *rdataset, + isc_result_t + dns_rdataset_additionaldata(dns_rdataset_t *rdataset, + dns_additionaldatafunc_t add, void *arg) ++{ ++ return dns_rdataset_additionaldata2(rdataset, add, arg, 0); ++} ++ ++isc_result_t ++dns_rdataset_additionaldata2(dns_rdataset_t *rdataset, ++ dns_additionaldatafunc_t add, void *arg, size_t limit) + { + dns_rdata_t rdata = DNS_RDATA_INIT; + isc_result_t result; +@@ -620,6 +628,10 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset, + REQUIRE(DNS_RDATASET_VALID(rdataset)); + REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0); + ++ if (limit != 0 && dns_rdataset_count(rdataset) > limit) { ++ return DNS_R_TOOMANYRECORDS; ++ } ++ + result = dns_rdataset_first(rdataset); + if (result != ISC_R_SUCCESS) + return (result); +-- +2.48.1 + diff --git a/bind.spec b/bind.spec index 7c6c5c5..0d1b6e0 100644 --- a/bind.spec +++ b/bind.spec @@ -68,7 +68,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind License: MPLv2.0 Version: 9.11.36 -Release: 16%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.2 +Release: 16%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.3 Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -197,6 +197,9 @@ Patch205: bind-9.11-CVE-2024-1975.patch Patch206: bind-9.11-CVE-2024-1737.patch # RH downstream, allow changing by environment Patch208: bind-9.11-CVE-2024-1737-runtime-env.patch +# https://gitlab.isc.org/isc-projects/bind9/-/commit/c6e6a7af8ac6b575dd3657b0f5cf4248d734c2b0 +Patch209: bind-9.18-CVE-2024-11187-pre-test.patch +Patch210: bind-9.18-CVE-2024-11187.patch # SDB patches Patch11: bind-9.3.2b2-sdbsrc.patch @@ -620,6 +623,8 @@ are used for building ISC DHCP. %patch205 -p1 -b .CVE-2024-1975 %patch206 -p1 -b .CVE-2024-1737 %patch208 -p1 -b .CVE-2024-1737-env +%patch209 -p1 -b .CVE-2024-11187-pre-test +%patch210 -p1 -b .CVE-2024-11187 mkdir lib/dns/tests/testdata/dstrandom cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data @@ -1672,6 +1677,10 @@ rm -rf ${RPM_BUILD_ROOT} %endif %changelog +* Wed Feb 05 2025 Petr Menšík - 32:9.11.36-16.3 +- Limit additional section records CPU processing (CVE-2024-11187) +- Correct ANY queries to not have additional data appended + * Tue Aug 06 2024 Petr Menšík - 32:9.11.36-16.2 - Rebuild after CI change