rpms/bind
7
0
Fork 1
Code Issues Pull Requests Releases Activity

Fix CVE-2026-5950

Browse Source 
Resolves: RHEL-189755
This commit is contained in:
Fedor Vorobev 2026-08-14 13:46:00 +02:00
parent 5ed33ea03a
commit dbd0424957
2 changed files with 106 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

100
bind-9.16-CVE-2026-5950.patch Normal file
View File

@ -0,0 +1,100 @@
From 7db71630557999e1ce1775c45498a59243fc8b51 Mon Sep 17 00:00:00 2001
From: Colin Vidal <colin@isc.org>
Date: Tue, 7 Apr 2026 22:18:10 +0200
Subject: [PATCH 1/2] Refactor incrementing query counters
Move the logic incrementing the query counter and the global query
counter into a dedicated helper function.
(cherry picked from commit 00345dde8feadf6601c864f000d99e42986159d9)
---
lib/dns/resolver.c | 21 ++++++++++++++++-----
1 file changed, 16 insertions(+), 5 deletions(-)
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 1226a4e..b0dcef9 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -4294,6 +4294,21 @@ fctx_nextaddress(fetchctx_t *fctx) {
return (addrinfo);
}
+static isc_result_t
+incr_query_counters(fetchctx_t *fctx) {
+ isc_result_t result;
+
+ result = isc_counter_increment(fctx->qc);
+ if (result != ISC_R_SUCCESS) {
+ isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+ DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
+ "exceeded max queries resolving '%s'",
+ fctx->info);
+ }
+
+ return result;
+}
+
static void
fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
isc_result_t result;
@@ -4433,12 +4448,8 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
return;
}
- result = isc_counter_increment(fctx->qc);
+ result = incr_query_counters(fctx);
if (result != ISC_R_SUCCESS) {
- isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
- DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
- "exceeded max queries resolving '%s'",
- fctx->info);
fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
return;
}
--
2.55.0
From 305a59b8fa2661ec628de16a9cb0e7cf7d503156 Mon Sep 17 00:00:00 2001
From: Colin Vidal <colin@isc.org>
Date: Tue, 7 Apr 2026 22:18:58 +0200
Subject: [PATCH 2/2] rctx_resend() increment query counters
Calls to `rctx_resend()` are done internally within the resolver, in
flow which are not supposed to happens more than once. For instance,
if some query fails, and a specific flag "F" wasn't set, then set the
flag and try again. This wouldn't occur more than once because if the
query fails the next attempt, the flag "F" would be set already, so the
resolver would move to the next server (or give up).
However, a subtle bug missing checking a flag, for instance, could lead
to an unbounded loop re-trying to query the same server. This is now
impossible as `rctx_resend()` also increment the query counters (so if
such case occurs, it would stop once the maximum limit is reached).
(cherry picked from commit b863694b32f8f764ae7475939888aebe99425b90)
---
lib/dns/resolver.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index b0dcef9..0807341 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -10109,6 +10109,13 @@ rctx_resend(respctx_t *rctx, dns_adbaddrinfo_t *addrinfo) {
unsigned int bucketnum;
FCTXTRACE("resend");
+
+ result = incr_query_counters(fctx);
+ if (result != ISC_R_SUCCESS) {
+ fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
+ return;
+ }
+
inc_stats(fctx->res, dns_resstatscounter_retry);
fctx_increference(fctx);
result = fctx_query(fctx, addrinfo, rctx->retryopts);
--
2.55.0

7
bind.spec
View File

@ -54,7 +54,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
Name: bind
License: MPLv2.0
Version: 9.16.50
Release: 6%{?dist}
Release: 7%{?dist}
Epoch: 32
Url: https://www.isc.org/downloads/bind/
#
@ -180,6 +180,8 @@ Patch240: bind-9.16-CVE-2026-11331.patch
Patch241: bind-9.16-CVE-2026-13321.patch
# https://github.com/isc-projects/bind9/commit/238ec379e9bed56383ba2333e711e554b139ac13
Patch242: bind-9.16-CVE-2026-10723.patch
# https://gitlab.isc.org/isc-projects/bind9/-/commit/379ca10cf34759d0c007cebcd9280911161bca1a
Patch243: bind-9.16-CVE-2026-5950.patch
%{?systemd_ordering}
@ -1238,6 +1240,9 @@ fi;
%endif
%changelog
* Fri Aug 14 2026 Fedor Vorobev <fvorobev@redhat.com> - 32:9.16.50-7
- Fix unbounded resend loop in resolver (CVE-2026-5950)
* Fri Aug 14 2026 Fedor Vorobev <fvorobev@redhat.com> - 32:9.16.50-6
- Fix NSEC3 signer validation (CVE-2026-10723)
- Fix reject out-of-zone NSEC next owner names (CVE-2026-13321)