rpms/bind
7
0
Fork 1
Code Issues Pull Requests Releases Activity

Fix CVE-2026-10723: validate NSEC3 signer matches owning zone

Browse Source 
Backport upstream fix for CVE-2026-10723 to bind-9.18.33.
The patch adds NSEC3 signer validation in dns_dnssec_verify()
to reject signatures whose signer field doesn't match the zone
owning the NSEC3 record. This prevents a child zone from
impersonating its parent zone and forging NXDOMAIN responses
for sibling domains. The error message for DNS_R_INVALIDNSEC3
is also updated to reflect the broader scope of the check.

CVE: CVE-2026-10723
Upstream patches:
 - c9cb6a5e24.patch
Resolves: RHEL-215707

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-27 09:28:41 +00:00 committed by Petr Menšík
parent f3827d3413
commit a33625773e
2 changed files with 69 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
bind-9.18-CVE-2026-10723.patch Normal file
View File

@ -0,0 +1,63 @@
From 01bb483cbf162b79dde64f7005f2cbc76aaee96e Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Thu, 21 May 2026 14:41:55 -0700
Subject: [PATCH] Check NSEC3 signer matches the owning zone
When validating NSEC3 records, reject any signature whose signer field
does not match the zone owning the NSEC3.
This ensures that a child zone cannot impersonate its parent and forge
NXDOMAIN responses for sibling domains.
Fixes: isc-projects/bind9#5874
(cherry picked from commit 6e5066bb1f0f12d090e8707adb7d6ccf74f8012b)
---
lib/dns/dnssec.c | 19 +++++++++++++++++--
lib/isc/result.c | 2 +-
2 files changed, 18 insertions(+), 3 deletions(-)
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 662136db87..d6259f939e 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -424,10 +424,25 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
}
/*
- * NS, SOA and DNSSKEY records are signed by their owner.
- * DS records are signed by the parent.
+ * NS, SOA and DNSSKEY records are signed by their owners.
+ * NSEC3 records are signed by the apex, exactly one level up
+ * from their owner names.
+ * DS records are signed by the parent zone.
*/
switch (set->type) {
+ case dns_rdatatype_nsec3: {
+ dns_name_t apex = DNS_NAME_INITEMPTY;
+ labels = dns_name_countlabels(name);
+ if (labels <= 1) {
+ inc_stat(dns_dnssecstats_fail);
+ return DNS_R_INVALIDNSEC3;
+ }
+ dns_name_split(name, labels - 1, NULL, &apex);
+ if (!dns_name_equal(&apex, &sig.signer)) {
+ inc_stat(dns_dnssecstats_fail);
+ return DNS_R_SIGINVALID;
+ }
+ } break;
case dns_rdatatype_ns:
case dns_rdatatype_soa:
case dns_rdatatype_dnskey:
diff --git a/lib/isc/result.c b/lib/isc/result.c
index 493c1a5309..5e242ac285 100644
--- a/lib/isc/result.c
+++ b/lib/isc/result.c
@@ -198,7 +198,7 @@ static const char *description[ISC_R_NRESULTS] = {
[DNS_R_COVERINGNSEC] = "covering NSEC record returned",
[DNS_R_MXISADDRESS] = "MX is an address",
[DNS_R_DUPLICATE] = "duplicate query",
- [DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name (wildcard)",
+ [DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name",
[DNS_R_NOTPRIMARY] = "not primary",
[DNS_R_BROKENCHAIN] = "broken trust chain",
[DNS_R_EXPIRED] = "expired",

7
bind.spec
View File

@ -80,7 +80,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
# Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
# Updating just bind will cause freeipa-dns-server package to be uninstallable.
Version: 9.18.33
Release: 24%{?dist}
Release: 25%{?dist}
Epoch: 32
Url: https://www.isc.org/downloads/bind/
#
@ -180,6 +180,8 @@ Patch238: bind-9.18-CVE-2026-11721.patch
Patch239: bind-9.18-CVE-2026-11622.patch
# https://github.com/isc-projects/bind9/commit/36f3d50f9c8ebc8d25ee033e707ca502e20b083f
Patch240: bind-9.18-CVE-2026-13321.patch
# https://github.com/isc-projects/bind9/commit/c9cb6a5e24e43489cf3fd4d4cc2193b6a74499cb
Patch241: bind-9.18-CVE-2026-10723.patch
%{?systemd_ordering}
# https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@ -981,6 +983,9 @@ fi;
%endif
%changelog
* Mon Jul 27 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.18.33-25
- Validate NSEC3 signer matches owning zone (CVE-2026-10723)
* Fri Jul 24 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.18.33-24
- Reject out-of-zone NSEC next owner names (CVE-2026-13321)