bind/bind-9.16-CVE-2026-5950.patch
Fedor Vorobev dbd0424957 Fix CVE-2026-5950
Resolves: RHEL-189755
2026-08-14 14:00:16 +02:00

101 lines
3.1 KiB
Diff

From 7db71630557999e1ce1775c45498a59243fc8b51 Mon Sep 17 00:00:00 2001
From: Colin Vidal <colin@isc.org>
Date: Tue, 7 Apr 2026 22:18:10 +0200
Subject: [PATCH 1/2] Refactor incrementing query counters
Move the logic incrementing the query counter and the global query
counter into a dedicated helper function.
(cherry picked from commit 00345dde8feadf6601c864f000d99e42986159d9)
---
lib/dns/resolver.c | 21 ++++++++++++++++-----
1 file changed, 16 insertions(+), 5 deletions(-)
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 1226a4e..b0dcef9 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -4294,6 +4294,21 @@ fctx_nextaddress(fetchctx_t *fctx) {
return (addrinfo);
}
+static isc_result_t
+incr_query_counters(fetchctx_t *fctx) {
+ isc_result_t result;
+
+ result = isc_counter_increment(fctx->qc);
+ if (result != ISC_R_SUCCESS) {
+ isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+ DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
+ "exceeded max queries resolving '%s'",
+ fctx->info);
+ }
+
+ return result;
+}
+
static void
fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
isc_result_t result;
@@ -4433,12 +4448,8 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
return;
}
- result = isc_counter_increment(fctx->qc);
+ result = incr_query_counters(fctx);
if (result != ISC_R_SUCCESS) {
- isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
- DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
- "exceeded max queries resolving '%s'",
- fctx->info);
fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
return;
}
--
2.55.0
From 305a59b8fa2661ec628de16a9cb0e7cf7d503156 Mon Sep 17 00:00:00 2001
From: Colin Vidal <colin@isc.org>
Date: Tue, 7 Apr 2026 22:18:58 +0200
Subject: [PATCH 2/2] rctx_resend() increment query counters
Calls to `rctx_resend()` are done internally within the resolver, in
flow which are not supposed to happens more than once. For instance,
if some query fails, and a specific flag "F" wasn't set, then set the
flag and try again. This wouldn't occur more than once because if the
query fails the next attempt, the flag "F" would be set already, so the
resolver would move to the next server (or give up).
However, a subtle bug missing checking a flag, for instance, could lead
to an unbounded loop re-trying to query the same server. This is now
impossible as `rctx_resend()` also increment the query counters (so if
such case occurs, it would stop once the maximum limit is reached).
(cherry picked from commit b863694b32f8f764ae7475939888aebe99425b90)
---
lib/dns/resolver.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index b0dcef9..0807341 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -10109,6 +10109,13 @@ rctx_resend(respctx_t *rctx, dns_adbaddrinfo_t *addrinfo) {
unsigned int bucketnum;
FCTXTRACE("resend");
+
+ result = incr_query_counters(fctx);
+ if (result != ISC_R_SUCCESS) {
+ fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
+ return;
+ }
+
inc_stats(fctx->res, dns_resstatscounter_retry);
fctx_increference(fctx);
result = fctx_query(fctx, addrinfo, rctx->retryopts);
--
2.55.0