From dbd0424957916deaef3160dacfa499e8bc23f658 Mon Sep 17 00:00:00 2001 From: Fedor Vorobev Date: Fri, 14 Aug 2026 13:46:00 +0200 Subject: [PATCH] Fix CVE-2026-5950 Resolves: RHEL-189755 --- bind-9.16-CVE-2026-5950.patch | 100 ++++++++++++++++++++++++++++++++++ bind.spec | 7 ++- 2 files changed, 106 insertions(+), 1 deletion(-) create mode 100644 bind-9.16-CVE-2026-5950.patch diff --git a/bind-9.16-CVE-2026-5950.patch b/bind-9.16-CVE-2026-5950.patch new file mode 100644 index 0000000..236c932 --- /dev/null +++ b/bind-9.16-CVE-2026-5950.patch @@ -0,0 +1,100 @@ +From 7db71630557999e1ce1775c45498a59243fc8b51 Mon Sep 17 00:00:00 2001 +From: Colin Vidal +Date: Tue, 7 Apr 2026 22:18:10 +0200 +Subject: [PATCH 1/2] Refactor incrementing query counters + +Move the logic incrementing the query counter and the global query +counter into a dedicated helper function. + +(cherry picked from commit 00345dde8feadf6601c864f000d99e42986159d9) +--- + lib/dns/resolver.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c +index 1226a4e..b0dcef9 100644 +--- a/lib/dns/resolver.c ++++ b/lib/dns/resolver.c +@@ -4294,6 +4294,21 @@ fctx_nextaddress(fetchctx_t *fctx) { + return (addrinfo); + } + ++static isc_result_t ++incr_query_counters(fetchctx_t *fctx) { ++ isc_result_t result; ++ ++ result = isc_counter_increment(fctx->qc); ++ if (result != ISC_R_SUCCESS) { ++ isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, ++ DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), ++ "exceeded max queries resolving '%s'", ++ fctx->info); ++ } ++ ++ return result; ++} ++ + static void + fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) { + isc_result_t result; +@@ -4433,12 +4448,8 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) { + return; + } + +- result = isc_counter_increment(fctx->qc); ++ result = incr_query_counters(fctx); + if (result != ISC_R_SUCCESS) { +- isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, +- DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), +- "exceeded max queries resolving '%s'", +- fctx->info); + fctx_done(fctx, DNS_R_SERVFAIL, __LINE__); + return; + } +-- +2.55.0 + + +From 305a59b8fa2661ec628de16a9cb0e7cf7d503156 Mon Sep 17 00:00:00 2001 +From: Colin Vidal +Date: Tue, 7 Apr 2026 22:18:58 +0200 +Subject: [PATCH 2/2] rctx_resend() increment query counters + +Calls to `rctx_resend()` are done internally within the resolver, in +flow which are not supposed to happens more than once. For instance, +if some query fails, and a specific flag "F" wasn't set, then set the +flag and try again. This wouldn't occur more than once because if the +query fails the next attempt, the flag "F" would be set already, so the +resolver would move to the next server (or give up). + +However, a subtle bug missing checking a flag, for instance, could lead +to an unbounded loop re-trying to query the same server. This is now +impossible as `rctx_resend()` also increment the query counters (so if +such case occurs, it would stop once the maximum limit is reached). + +(cherry picked from commit b863694b32f8f764ae7475939888aebe99425b90) +--- + lib/dns/resolver.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c +index b0dcef9..0807341 100644 +--- a/lib/dns/resolver.c ++++ b/lib/dns/resolver.c +@@ -10109,6 +10109,13 @@ rctx_resend(respctx_t *rctx, dns_adbaddrinfo_t *addrinfo) { + unsigned int bucketnum; + + FCTXTRACE("resend"); ++ ++ result = incr_query_counters(fctx); ++ if (result != ISC_R_SUCCESS) { ++ fctx_done(fctx, DNS_R_SERVFAIL, __LINE__); ++ return; ++ } ++ + inc_stats(fctx->res, dns_resstatscounter_retry); + fctx_increference(fctx); + result = fctx_query(fctx, addrinfo, rctx->retryopts); +-- +2.55.0 + diff --git a/bind.spec b/bind.spec index 482ba3b..72242b0 100644 --- a/bind.spec +++ b/bind.spec @@ -54,7 +54,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind License: MPLv2.0 Version: 9.16.50 -Release: 6%{?dist} +Release: 7%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -180,6 +180,8 @@ Patch240: bind-9.16-CVE-2026-11331.patch Patch241: bind-9.16-CVE-2026-13321.patch # https://github.com/isc-projects/bind9/commit/238ec379e9bed56383ba2333e711e554b139ac13 Patch242: bind-9.16-CVE-2026-10723.patch +# https://gitlab.isc.org/isc-projects/bind9/-/commit/379ca10cf34759d0c007cebcd9280911161bca1a +Patch243: bind-9.16-CVE-2026-5950.patch %{?systemd_ordering} @@ -1238,6 +1240,9 @@ fi; %endif %changelog +* Fri Aug 14 2026 Fedor Vorobev - 32:9.16.50-7 +- Fix unbounded resend loop in resolver (CVE-2026-5950) + * Fri Aug 14 2026 Fedor Vorobev - 32:9.16.50-6 - Fix NSEC3 signer validation (CVE-2026-10723) - Fix reject out-of-zone NSEC next owner names (CVE-2026-13321)