From c33c243462cb6c353154fe3653afccb76dba9459 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Mon, 27 Jul 2026 15:50:38 +0000 Subject: [PATCH] Fix CVE-2026-10723: validate NSEC3 signer matches owning zone Backport upstream fix for CVE-2026-10723 to bind 9.11.36. The patch adds NSEC3 signer verification in lib/dns/dnssec.c, rejecting signatures whose signer field does not match the zone owning the NSEC3 record. This prevents a child zone from impersonating its parent to forge NXDOMAIN responses for sibling domains. The error message for DNS_R_INVALIDNSEC3 in lib/dns/result.c is also updated accordingly. CVE: CVE-2026-10723 Upstream patches: - https://github.com/isc-projects/bind9/commit/6965fa47edd3b45538db2b16488dbb6b4ad8066a.patch Resolves: RHEL-215710 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- bind-9.11-CVE-2026-10723.patch | 64 ++++++++++++++++++++++++++++++++++ bind.spec | 8 ++++- 2 files changed, 71 insertions(+), 1 deletion(-) create mode 100644 bind-9.11-CVE-2026-10723.patch diff --git a/bind-9.11-CVE-2026-10723.patch b/bind-9.11-CVE-2026-10723.patch new file mode 100644 index 0000000..886b047 --- /dev/null +++ b/bind-9.11-CVE-2026-10723.patch @@ -0,0 +1,64 @@ +From 6e7215866cf1b9d92b7cdbb5e1990f0f7581336a Mon Sep 17 00:00:00 2001 +From: Evan Hunt +Date: Wed, 1 Jul 2026 23:24:09 -0700 +Subject: [PATCH] Check NSEC3 signer matches the owning zone + +When validating NSEC3 records, reject any signature whose signer field +does not match the zone owning the NSEC3. + +This ensures that a child zone cannot impersonate its parent and forge +NXDOMAIN responses for sibling domains. + +Fixes: isc-projects/bind9#5874 + +(cherry picked from commit 6e5066bb1f0f12d090e8707adb7d6ccf74f8012b) +--- + lib/dns/dnssec.c | 19 +++++++++++++++++-- + lib/dns/result.c | 2 +- + 2 files changed, 18 insertions(+), 3 deletions(-) + +diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c +index b6b2405..8dae801 100644 +--- a/lib/dns/dnssec.c ++++ b/lib/dns/dnssec.c +@@ -428,10 +428,25 @@ dns_dnssec_verify3(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + } + + /* +- * NS, SOA and DNSSKEY records are signed by their owner. +- * DS records are signed by the parent. ++ * NS, SOA and DNSKEY records are signed by their owners. ++ * NSEC3 records are signed by the apex, exactly one level up ++ * from their owner names. ++ * DS records are signed by the parent zone. + */ + switch (set->type) { ++ case dns_rdatatype_nsec3: { ++ dns_name_t apex = DNS_NAME_INITEMPTY; ++ labels = dns_name_countlabels(name); ++ if (labels <= 1) { ++ inc_stat(dns_dnssecstats_fail); ++ return DNS_R_INVALIDNSEC3; ++ } ++ dns_name_split(name, labels - 1, NULL, &apex); ++ if (!dns_name_equal(&apex, &sig.signer)) { ++ inc_stat(dns_dnssecstats_fail); ++ return DNS_R_SIGINVALID; ++ } ++ } break; + case dns_rdatatype_ns: + case dns_rdatatype_soa: + case dns_rdatatype_dnskey: +diff --git a/lib/dns/result.c b/lib/dns/result.c +index 24aa01e..45ac114 100644 +--- a/lib/dns/result.c ++++ b/lib/dns/result.c +@@ -148,7 +148,7 @@ static const char *text[DNS_R_NRESULTS] = { + "covering NSEC record returned", /*%< 101 DNS_R_COVERINGNSEC */ + "MX is an address", /*%< 102 DNS_R_MXISADDRESS */ + "duplicate query", /*%< 103 DNS_R_DUPLICATE */ +- "invalid NSEC3 owner name (wildcard)", /*%< 104 DNS_R_INVALIDNSEC3 */ ++ "invalid NSEC3 owner name", /*%< 104 DNS_R_INVALIDNSEC3 */ + + "not master", /*%< 105 DNS_R_NOTMASTER */ + "broken trust chain", /*%< 106 DNS_R_BROKENCHAIN */ diff --git a/bind.spec b/bind.spec index 5353a29..4682c38 100644 --- a/bind.spec +++ b/bind.spec @@ -68,7 +68,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind License: MPLv2.0 Version: 9.11.36 -Release: 16%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.12 +Release: 16%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.14 Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -222,6 +222,8 @@ Patch219: bind-9.11-CVE-2026-11721.patch Patch220: bind-9.11-CVE-2026-13321.patch # https://github.com/isc-projects/bind9/commit/204fde85953d78475334694a7b9507dca47e73ba Patch221: bind-9.11-CVE-2026-13204.patch +# https://github.com/isc-projects/bind9/commit/6965fa47edd3b45538db2b16488dbb6b4ad8066a +Patch223: bind-9.11-CVE-2026-10723.patch # SDB patches Patch11: bind-9.3.2b2-sdbsrc.patch @@ -658,6 +660,7 @@ are used for building ISC DHCP. %patch -P 219 -p1 -b .CVE-2026-11721 %patch -P 220 -p1 -b .CVE-2026-13321 %patch -P 221 -p1 -b .CVE-2026-13204 +%patch -P 223 -p1 -b .CVE-2026-10723 mkdir lib/dns/tests/testdata/dstrandom cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data @@ -1710,6 +1713,9 @@ rm -rf ${RPM_BUILD_ROOT} %endif %changelog +* Mon Jul 27 2026 RHEL Packaging Agent - 32:9.11.36-16.14 +- Validate NSEC3 signer matches owning zone (CVE-2026-10723) + * Mon Jul 27 2026 RHEL Packaging Agent - 32:9.11.36-16.12 - Prevent accepting unsigned NSEC/NSEC3 records (CVE-2026-13204)