12f1cd3444
6192. [security] A query that prioritizes stale data over lookup triggers a fetch to refresh the stale data in cache. If the fetch is aborted for exceeding the recursion quota, it was possible for 'named' to enter an infinite callback loop and crash due to stack overflow. This has been fixed. (CVE-2023-2911) [GL #4089] Resolves: CVE-2023-2911
38 lines
1.0 KiB
Diff
38 lines
1.0 KiB
Diff
From e73ecbf039c3b2cd33dd2926691a8a346c9ca574 Mon Sep 17 00:00:00 2001
|
|
From: Matthijs Mekking <matthijs@isc.org>
|
|
Date: Tue, 2 Aug 2022 14:21:40 +0200
|
|
Subject: [PATCH 1/3] Don't enable serve-stale on duplicate queries
|
|
|
|
When checking if we should enable serve-stale, add an early out case
|
|
when the result is an error signalling a duplicate query or a query
|
|
that would be dropped.
|
|
|
|
(cherry picked from commit 059a4c2f4d9d3cff371842f43208d021509314fa)
|
|
(cherry picked from commit dd7dde5743715dc0dec2defbb92b1a8637977bf9)
|
|
---
|
|
lib/ns/query.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/lib/ns/query.c b/lib/ns/query.c
|
|
index 4f61374e2c..c169e22bf4 100644
|
|
--- a/lib/ns/query.c
|
|
+++ b/lib/ns/query.c
|
|
@@ -7205,6 +7205,14 @@ query_usestale(query_ctx_t *qctx, isc_result_t result) {
|
|
return (false);
|
|
}
|
|
|
|
+ if (result == DNS_R_DUPLICATE || result == DNS_R_DROP) {
|
|
+ /*
|
|
+ * Don't enable serve-stale if the result signals a duplicate
|
|
+ * query or query that is being dropped.
|
|
+ */
|
|
+ return (false);
|
|
+ }
|
|
+
|
|
qctx_clean(qctx);
|
|
qctx_freedata(qctx);
|
|
|
|
--
|
|
2.40.1
|
|
|