12f1cd3444
6192. [security] A query that prioritizes stale data over lookup triggers a fetch to refresh the stale data in cache. If the fetch is aborted for exceeding the recursion quota, it was possible for 'named' to enter an infinite callback loop and crash due to stack overflow. This has been fixed. (CVE-2023-2911) [GL #4089] Resolves: CVE-2023-2911
61 lines
2.0 KiB
Diff
61 lines
2.0 KiB
Diff
From c20e9d30bae58d3120aa7c6a0e5dcae0e7e93dbd Mon Sep 17 00:00:00 2001
|
|
From: Matthijs Mekking <matthijs@isc.org>
|
|
Date: Thu, 1 Jun 2023 10:03:48 +0200
|
|
Subject: [PATCH 3/3] Fix serve-stale hang at shutdown
|
|
|
|
The 'refresh_rrset' variable is used to determine if we can detach from
|
|
the client. This can cause a hang on shutdown. To fix this, move setting
|
|
of the 'nodetach' variable up to where 'refresh_rrset' is set (in
|
|
query_lookup(), and thus not in ns_query_done()), and set it to false
|
|
when actually refreshing the RRset, so that when this lookup is
|
|
completed, the client will be detached.
|
|
|
|
(cherry picked from commit c003c5bc3c68f3e513654b6689e1f60280d14844)
|
|
---
|
|
lib/ns/query.c | 13 ++++++++-----
|
|
1 file changed, 8 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/lib/ns/query.c b/lib/ns/query.c
|
|
index 1eb662ea4d..4fe3e30f45 100644
|
|
--- a/lib/ns/query.c
|
|
+++ b/lib/ns/query.c
|
|
@@ -5644,6 +5644,7 @@ query_refresh_rrset(query_ctx_t *orig_qctx) {
|
|
qctx.client->query.dboptions &= ~(DNS_DBFIND_STALETIMEOUT |
|
|
DNS_DBFIND_STALEOK |
|
|
DNS_DBFIND_STALEENABLED);
|
|
+ qctx.client->nodetach = false;
|
|
|
|
/*
|
|
* We'll need some resources...
|
|
@@ -5868,7 +5869,14 @@ query_lookup(query_ctx_t *qctx) {
|
|
"%s stale answer used, an attempt to "
|
|
"refresh the RRset will still be made",
|
|
namebuf);
|
|
+
|
|
qctx->refresh_rrset = STALE(qctx->rdataset);
|
|
+
|
|
+ /*
|
|
+ * If we are refreshing the RRSet, we must not
|
|
+ * detach from the client in query_send().
|
|
+ */
|
|
+ qctx->client->nodetach = qctx->refresh_rrset;
|
|
}
|
|
} else {
|
|
/*
|
|
@@ -11469,12 +11477,7 @@ ns_query_done(query_ctx_t *qctx) {
|
|
/*
|
|
* Client may have been detached after query_send(), so
|
|
* we test and store the flag state here, for safety.
|
|
- * If we are refreshing the RRSet, we must not detach from the client
|
|
- * in the query_send(), so we need to override the flag.
|
|
*/
|
|
- if (qctx->refresh_rrset) {
|
|
- qctx->client->nodetach = true;
|
|
- }
|
|
nodetach = qctx->client->nodetach;
|
|
query_send(qctx->client);
|
|
|
|
--
|
|
2.40.1
|
|
|