Fix CVE-2026-13321: reject out-of-zone NSEC next owner names
Backport upstream commit af84538a2ce6 to fix CVE-2026-13321.
The patch adds validation in dns_dnssec_verify() to reject
out-of-zone NSEC next owner names by checking that the NSEC
next name is a subdomain of the signer field, as required by
RFC 4034 section 4.1.1.
CVE: CVE-2026-13321
Upstream patches:
- af84538a2c.patch
Resolves: RHEL-213313
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
Petr Menšík
parent
1081165d67
commit
69fc1b29c6
85
bind-9.16-CVE-2026-13321.patch
Normal file
85
bind-9.16-CVE-2026-13321.patch
Normal file
@ -0,0 +1,85 @@
|
||||
From db08a828d3a2fae9bdcc901645d63adcd9d090eb Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Ayd=C4=B1n=20Mercan?= <aydin@isc.org>
|
||||
Date: Thu, 7 May 2026 18:59:20 +0300
|
||||
Subject: [PATCH] Reject out-of-zone NSEC next owner names
|
||||
|
||||
When verifying DNSSEC records, make sure that a next owner name of
|
||||
an NSEC record is a subdomain of the signer field.
|
||||
|
||||
This follows the specification RFC 4034, section 4.1.1:
|
||||
|
||||
Owner names of RRsets for which the given zone is not authoritative
|
||||
(such as glue records) MUST NOT be listed in the Next Domain Name
|
||||
unless at least one authoritative RRset exists at the same owner
|
||||
name.
|
||||
|
||||
While the above paragraph is intended for glue records, it also
|
||||
applies to out-of-zone data.
|
||||
|
||||
(cherry picked from commit 4065512d25b71605b9502bb69dfb903776d35aa9)
|
||||
---
|
||||
lib/dns/dnssec.c | 17 +++++++++++++++++
|
||||
lib/dns/include/dns/dnssec.h | 6 ++++++
|
||||
2 files changed, 23 insertions(+)
|
||||
|
||||
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
|
||||
index c168fed..2ab9c02 100644
|
||||
--- a/lib/dns/dnssec.c
|
||||
+++ b/lib/dns/dnssec.c
|
||||
@@ -376,8 +376,10 @@ isc_result_t
|
||||
dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
|
||||
bool ignoretime, unsigned int maxbits, isc_mem_t *mctx,
|
||||
dns_rdata_t *sigrdata, dns_name_t *wild) {
|
||||
+ dns_rdata_nsec_t nsec;
|
||||
dns_rdata_rrsig_t sig;
|
||||
dns_fixedname_t fnewname;
|
||||
+ dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||
isc_region_t r;
|
||||
isc_buffer_t envbuf;
|
||||
dns_rdata_t *rdatas;
|
||||
@@ -451,6 +453,21 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
|
||||
}
|
||||
break;
|
||||
}
|
||||
+ /*
|
||||
+ * Check for out of zone NSEC entries.
|
||||
+ */
|
||||
+ if (set->type == dns_rdatatype_nsec) {
|
||||
+ if (dns_rdataset_first(set) != ISC_R_SUCCESS) {
|
||||
+ return (DNS_R_NOVALIDNSEC);
|
||||
+ }
|
||||
+ dns_rdataset_current(set, &rdata);
|
||||
+ if (dns_rdata_tostruct(&rdata, &nsec, NULL) != ISC_R_SUCCESS) {
|
||||
+ return (DNS_R_NOVALIDNSEC);
|
||||
+ }
|
||||
+ if (!dns_name_issubdomain(&nsec.next, &sig.signer)) {
|
||||
+ return (DNS_R_NOVALIDNSEC);
|
||||
+ }
|
||||
+ }
|
||||
|
||||
/*
|
||||
* Is the key allowed to sign data?
|
||||
diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h
|
||||
index e74ec47..c811e25 100644
|
||||
--- a/lib/dns/include/dns/dnssec.h
|
||||
+++ b/lib/dns/include/dns/dnssec.h
|
||||
@@ -133,6 +133,9 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
|
||||
* this record, as this requires a resolver or database.
|
||||
* If 'ignoretime' is true, temporal validity will not be checked.
|
||||
*
|
||||
+ * If 'set' is of type NSEC, this function also verifies that the
|
||||
+ * Next Name is a subdomain of the Signer's Name from 'sigrdata'.
|
||||
+ *
|
||||
* 'maxbits' specifies the maximum number of rsa exponent bits accepted.
|
||||
*
|
||||
* Requires:
|
||||
@@ -155,6 +158,9 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
|
||||
*\li #DNS_R_KEYUNAUTHORIZED - the key cannot sign this data (either
|
||||
* it is not a zone key or its flags prevent
|
||||
* authentication)
|
||||
+ *
|
||||
+ *\li #DNS_R_NOVALIDNSEC - the NSEC rdata is not valid
|
||||
+ *\li #DNS_R_KEYUNAUTHORIZED - the key cannot sign this data
|
||||
*\li DST_R_*
|
||||
*/
|
||||
|
||||
@ -62,7 +62,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
|
||||
Name: bind9.16
|
||||
License: MPLv2.0
|
||||
Version: 9.16.23
|
||||
Release: 0.22%{?dist}.10
|
||||
Release: 0.22%{?dist}.11
|
||||
Epoch: 32
|
||||
Url: https://www.isc.org/downloads/bind/
|
||||
#
|
||||
@ -196,6 +196,8 @@ Patch234: bind-9.16-CVE-2026-11331.patch
|
||||
Patch235: bind-9.16-CVE-2026-11721.patch
|
||||
# https://github.com/isc-projects/bind9/commit/c57695da31a338092528283fde4f8ed9048b2087
|
||||
Patch236: bind-9.16-CVE-2026-11622.patch
|
||||
# https://github.com/isc-projects/bind9/commit/af84538a2ce6722b89b8ef7f2a233a5c10d0207d
|
||||
Patch237: bind-9.16-CVE-2026-13321.patch
|
||||
|
||||
%{?systemd_ordering}
|
||||
Requires: coreutils
|
||||
@ -542,6 +544,7 @@ in HTML and PDF format.
|
||||
%patch234 -p1 -b .CVE-2026-11331
|
||||
%patch235 -p1 -b .CVE-2026-11721
|
||||
%patch236 -p1 -b .CVE-2026-11622
|
||||
%patch237 -p1 -b .CVE-2026-13321
|
||||
|
||||
%if %{with PKCS11}
|
||||
%patch135 -p1 -b .config-pkcs11
|
||||
@ -1284,6 +1287,10 @@ fi;
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.11
|
||||
- Reject out-of-zone NSEC next owner names (CVE-2026-13321)
|
||||
- Resolves: RHEL-213313
|
||||
|
||||
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.10
|
||||
- Fix CVE-2026-11622: reference-counted DNS cache slab headers
|
||||
- Resolves: RHEL-213396
|
||||
|
||||
Loading…
Reference in New Issue
Block a user