rpms/bind
7
0
Fork 1
Code Issues Pull Requests Releases Activity

Fix CVE-2026-10723: validate NSEC3 signer matches owning zone

Browse Source 
Backport upstream fix for CVE-2026-10723 to bind 9.11.36.
The patch adds NSEC3 signer verification in lib/dns/dnssec.c,
rejecting signatures whose signer field does not match the zone
owning the NSEC3 record. This prevents a child zone from
impersonating its parent to forge NXDOMAIN responses for
sibling domains. The error message for DNS_R_INVALIDNSEC3 in
lib/dns/result.c is also updated accordingly.

CVE: CVE-2026-10723
Upstream patches:
 - 6965fa47ed.patch
Resolves: RHEL-215710

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-27 15:50:38 +00:00 committed by Petr Menšík
parent cbdd087dd3
commit c33c243462
2 changed files with 71 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
bind-9.11-CVE-2026-10723.patch Normal file
View File

@ -0,0 +1,64 @@
From 6e7215866cf1b9d92b7cdbb5e1990f0f7581336a Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Wed, 1 Jul 2026 23:24:09 -0700
Subject: [PATCH] Check NSEC3 signer matches the owning zone
When validating NSEC3 records, reject any signature whose signer field
does not match the zone owning the NSEC3.
This ensures that a child zone cannot impersonate its parent and forge
NXDOMAIN responses for sibling domains.
Fixes: isc-projects/bind9#5874
(cherry picked from commit 6e5066bb1f0f12d090e8707adb7d6ccf74f8012b)
---
lib/dns/dnssec.c | 19 +++++++++++++++++--
lib/dns/result.c | 2 +-
2 files changed, 18 insertions(+), 3 deletions(-)
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index b6b2405..8dae801 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -428,10 +428,25 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
}
/*
- * NS, SOA and DNSSKEY records are signed by their owner.
- * DS records are signed by the parent.
+ * NS, SOA and DNSKEY records are signed by their owners.
+ * NSEC3 records are signed by the apex, exactly one level up
+ * from their owner names.
+ * DS records are signed by the parent zone.
*/
switch (set->type) {
+ case dns_rdatatype_nsec3: {
+ dns_name_t apex = DNS_NAME_INITEMPTY;
+ labels = dns_name_countlabels(name);
+ if (labels <= 1) {
+ inc_stat(dns_dnssecstats_fail);
+ return DNS_R_INVALIDNSEC3;
+ }
+ dns_name_split(name, labels - 1, NULL, &apex);
+ if (!dns_name_equal(&apex, &sig.signer)) {
+ inc_stat(dns_dnssecstats_fail);
+ return DNS_R_SIGINVALID;
+ }
+ } break;
case dns_rdatatype_ns:
case dns_rdatatype_soa:
case dns_rdatatype_dnskey:
diff --git a/lib/dns/result.c b/lib/dns/result.c
index 24aa01e..45ac114 100644
--- a/lib/dns/result.c
+++ b/lib/dns/result.c
@@ -148,7 +148,7 @@ static const char *text[DNS_R_NRESULTS] = {
"covering NSEC record returned", /*%< 101 DNS_R_COVERINGNSEC */
"MX is an address", /*%< 102 DNS_R_MXISADDRESS */
"duplicate query", /*%< 103 DNS_R_DUPLICATE */
- "invalid NSEC3 owner name (wildcard)", /*%< 104 DNS_R_INVALIDNSEC3 */
+ "invalid NSEC3 owner name", /*%< 104 DNS_R_INVALIDNSEC3 */
"not master", /*%< 105 DNS_R_NOTMASTER */
"broken trust chain", /*%< 106 DNS_R_BROKENCHAIN */

8
bind.spec
View File

@ -68,7 +68,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
Name: bind
License: MPLv2.0
Version: 9.11.36
Release: 16%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.12
Release: 16%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.14
Epoch: 32
Url: https://www.isc.org/downloads/bind/
#
@ -222,6 +222,8 @@ Patch219: bind-9.11-CVE-2026-11721.patch
Patch220: bind-9.11-CVE-2026-13321.patch
# https://github.com/isc-projects/bind9/commit/204fde85953d78475334694a7b9507dca47e73ba
Patch221: bind-9.11-CVE-2026-13204.patch
# https://github.com/isc-projects/bind9/commit/6965fa47edd3b45538db2b16488dbb6b4ad8066a
Patch223: bind-9.11-CVE-2026-10723.patch
# SDB patches
Patch11: bind-9.3.2b2-sdbsrc.patch
@ -658,6 +660,7 @@ are used for building ISC DHCP.
%patch -P 219 -p1 -b .CVE-2026-11721
%patch -P 220 -p1 -b .CVE-2026-13321
%patch -P 221 -p1 -b .CVE-2026-13204
%patch -P 223 -p1 -b .CVE-2026-10723
mkdir lib/dns/tests/testdata/dstrandom
cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
@ -1710,6 +1713,9 @@ rm -rf ${RPM_BUILD_ROOT}
%endif
%changelog
* Mon Jul 27 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.11.36-16.14
- Validate NSEC3 signer matches owning zone (CVE-2026-10723)
* Mon Jul 27 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.11.36-16.12
- Prevent accepting unsigned NSEC/NSEC3 records (CVE-2026-13204)