From 69fc1b29c61f51a716fc1386bf493f5ab323e5bd Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Thu, 23 Jul 2026 13:33:33 +0000 Subject: [PATCH] Fix CVE-2026-13321: reject out-of-zone NSEC next owner names Backport upstream commit af84538a2ce6 to fix CVE-2026-13321. The patch adds validation in dns_dnssec_verify() to reject out-of-zone NSEC next owner names by checking that the NSEC next name is a subdomain of the signer field, as required by RFC 4034 section 4.1.1. CVE: CVE-2026-13321 Upstream patches: - https://github.com/isc-projects/bind9/commit/af84538a2ce6722b89b8ef7f2a233a5c10d0207d.patch Resolves: RHEL-213313 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- bind-9.16-CVE-2026-13321.patch | 85 ++++++++++++++++++++++++++++++++++ bind9.16.spec | 9 +++- 2 files changed, 93 insertions(+), 1 deletion(-) create mode 100644 bind-9.16-CVE-2026-13321.patch diff --git a/bind-9.16-CVE-2026-13321.patch b/bind-9.16-CVE-2026-13321.patch new file mode 100644 index 0000000..26a55da --- /dev/null +++ b/bind-9.16-CVE-2026-13321.patch @@ -0,0 +1,85 @@ +From db08a828d3a2fae9bdcc901645d63adcd9d090eb Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ayd=C4=B1n=20Mercan?= +Date: Thu, 7 May 2026 18:59:20 +0300 +Subject: [PATCH] Reject out-of-zone NSEC next owner names + +When verifying DNSSEC records, make sure that a next owner name of +an NSEC record is a subdomain of the signer field. + +This follows the specification RFC 4034, section 4.1.1: + + Owner names of RRsets for which the given zone is not authoritative + (such as glue records) MUST NOT be listed in the Next Domain Name + unless at least one authoritative RRset exists at the same owner + name. + +While the above paragraph is intended for glue records, it also +applies to out-of-zone data. + +(cherry picked from commit 4065512d25b71605b9502bb69dfb903776d35aa9) +--- + lib/dns/dnssec.c | 17 +++++++++++++++++ + lib/dns/include/dns/dnssec.h | 6 ++++++ + 2 files changed, 23 insertions(+) + +diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c +index c168fed..2ab9c02 100644 +--- a/lib/dns/dnssec.c ++++ b/lib/dns/dnssec.c +@@ -376,8 +376,10 @@ isc_result_t + dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + bool ignoretime, unsigned int maxbits, isc_mem_t *mctx, + dns_rdata_t *sigrdata, dns_name_t *wild) { ++ dns_rdata_nsec_t nsec; + dns_rdata_rrsig_t sig; + dns_fixedname_t fnewname; ++ dns_rdata_t rdata = DNS_RDATA_INIT; + isc_region_t r; + isc_buffer_t envbuf; + dns_rdata_t *rdatas; +@@ -451,6 +453,21 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + } + break; + } ++ /* ++ * Check for out of zone NSEC entries. ++ */ ++ if (set->type == dns_rdatatype_nsec) { ++ if (dns_rdataset_first(set) != ISC_R_SUCCESS) { ++ return (DNS_R_NOVALIDNSEC); ++ } ++ dns_rdataset_current(set, &rdata); ++ if (dns_rdata_tostruct(&rdata, &nsec, NULL) != ISC_R_SUCCESS) { ++ return (DNS_R_NOVALIDNSEC); ++ } ++ if (!dns_name_issubdomain(&nsec.next, &sig.signer)) { ++ return (DNS_R_NOVALIDNSEC); ++ } ++ } + + /* + * Is the key allowed to sign data? +diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h +index e74ec47..c811e25 100644 +--- a/lib/dns/include/dns/dnssec.h ++++ b/lib/dns/include/dns/dnssec.h +@@ -133,6 +133,9 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + * this record, as this requires a resolver or database. + * If 'ignoretime' is true, temporal validity will not be checked. + * ++ * If 'set' is of type NSEC, this function also verifies that the ++ * Next Name is a subdomain of the Signer's Name from 'sigrdata'. ++ * + * 'maxbits' specifies the maximum number of rsa exponent bits accepted. + * + * Requires: +@@ -155,6 +158,9 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + *\li #DNS_R_KEYUNAUTHORIZED - the key cannot sign this data (either + * it is not a zone key or its flags prevent + * authentication) ++ * ++ *\li #DNS_R_NOVALIDNSEC - the NSEC rdata is not valid ++ *\li #DNS_R_KEYUNAUTHORIZED - the key cannot sign this data + *\li DST_R_* + */ + diff --git a/bind9.16.spec b/bind9.16.spec index df032d6..f735fa2 100644 --- a/bind9.16.spec +++ b/bind9.16.spec @@ -62,7 +62,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind9.16 License: MPLv2.0 Version: 9.16.23 -Release: 0.22%{?dist}.10 +Release: 0.22%{?dist}.11 Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -196,6 +196,8 @@ Patch234: bind-9.16-CVE-2026-11331.patch Patch235: bind-9.16-CVE-2026-11721.patch # https://github.com/isc-projects/bind9/commit/c57695da31a338092528283fde4f8ed9048b2087 Patch236: bind-9.16-CVE-2026-11622.patch +# https://github.com/isc-projects/bind9/commit/af84538a2ce6722b89b8ef7f2a233a5c10d0207d +Patch237: bind-9.16-CVE-2026-13321.patch %{?systemd_ordering} Requires: coreutils @@ -542,6 +544,7 @@ in HTML and PDF format. %patch234 -p1 -b .CVE-2026-11331 %patch235 -p1 -b .CVE-2026-11721 %patch236 -p1 -b .CVE-2026-11622 +%patch237 -p1 -b .CVE-2026-13321 %if %{with PKCS11} %patch135 -p1 -b .config-pkcs11 @@ -1284,6 +1287,10 @@ fi; %endif %changelog +* Thu Jul 23 2026 RHEL Packaging Agent - 32:9.16.23-0.22.11 +- Reject out-of-zone NSEC next owner names (CVE-2026-13321) +- Resolves: RHEL-213313 + * Thu Jul 23 2026 RHEL Packaging Agent - 32:9.16.23-0.22.10 - Fix CVE-2026-11622: reference-counted DNS cache slab headers - Resolves: RHEL-213396