rpms/bind9.16
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix NSEC3 signer validation (CVE-2026-10723)

Browse Source 
Backport upstream fix for CVE-2026-10723 to bind-9.16.23.
The patch adds NSEC3 signer validation in lib/dns/dnssec.c,
rejecting signatures whose signer doesn't match the owning
zone apex. This prevents a child zone from impersonating its
parent and forging NXDOMAIN responses for sibling domains.

CVE: CVE-2026-10723
Upstream patches:
 - 238ec379e9.patch
Resolves: RHEL-213499

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-23 14:10:16 +00:00 committed by Petr Menšík
parent 69fc1b29c6
commit af20c7fa33
2 changed files with 71 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
bind-9.16-CVE-2026-10723.patch Normal file
View File

@ -0,0 +1,63 @@
From 35e6c3ff81d289627c5b3d63a68187e450740e50 Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Thu, 21 May 2026 14:41:55 -0700
Subject: [PATCH] Check NSEC3 signer matches the owning zone
When validating NSEC3 records, reject any signature whose signer field
does not match the zone owning the NSEC3.
This ensures that a child zone cannot impersonate its parent and forge
NXDOMAIN responses for sibling domains.
Fixes: isc-projects/bind9#5874
(cherry picked from commit 6e5066bb1f0f12d090e8707adb7d6ccf74f8012b)
---
lib/dns/dnssec.c | 19 +++++++++++++++++--
lib/dns/result.c | 2 +-
2 files changed, 18 insertions(+), 3 deletions(-)
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index c168fed..a91cbe3 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -426,10 +426,25 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
}
/*
- * NS, SOA and DNSSKEY records are signed by their owner.
- * DS records are signed by the parent.
+ * NS, SOA and DNSKEY records are signed by their owners.
+ * NSEC3 records are signed by the apex, exactly one level up
+ * from their owner names.
+ * DS records are signed by the parent zone.
*/
switch (set->type) {
+ case dns_rdatatype_nsec3: {
+ dns_name_t apex = DNS_NAME_INITEMPTY;
+ labels = dns_name_countlabels(name);
+ if (labels <= 1) {
+ inc_stat(dns_dnssecstats_fail);
+ return DNS_R_INVALIDNSEC3;
+ }
+ dns_name_split(name, labels - 1, NULL, &apex);
+ if (!dns_name_equal(&apex, &sig.signer)) {
+ inc_stat(dns_dnssecstats_fail);
+ return DNS_R_SIGINVALID;
+ }
+ } break;
case dns_rdatatype_ns:
case dns_rdatatype_soa:
case dns_rdatatype_dnskey:
diff --git a/lib/dns/result.c b/lib/dns/result.c
index 01ce2b4..9ff2a3a 100644
--- a/lib/dns/result.c
+++ b/lib/dns/result.c
@@ -146,7 +146,7 @@ static const char *text[DNS_R_NRESULTS] = {
"covering NSEC record returned", /*%< 101 DNS_R_COVERINGNSEC */
"MX is an address", /*%< 102 DNS_R_MXISADDRESS */
"duplicate query", /*%< 103 DNS_R_DUPLICATE */
- "invalid NSEC3 owner name (wildcard)", /*%< 104 DNS_R_INVALIDNSEC3 */
+ "invalid NSEC3 owner name", /*%< 104 DNS_R_INVALIDNSEC3 */
"not master", /*%< 105 DNS_R_NOTMASTER */
"broken trust chain", /*%< 106 DNS_R_BROKENCHAIN */

9
bind9.16.spec
View File

@ -62,7 +62,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
Name: bind9.16
License: MPLv2.0
Version: 9.16.23
Release: 0.22%{?dist}.11
Release: 0.22%{?dist}.12
Epoch: 32
Url: https://www.isc.org/downloads/bind/
#
@ -198,6 +198,8 @@ Patch235: bind-9.16-CVE-2026-11721.patch
Patch236: bind-9.16-CVE-2026-11622.patch
# https://github.com/isc-projects/bind9/commit/af84538a2ce6722b89b8ef7f2a233a5c10d0207d
Patch237: bind-9.16-CVE-2026-13321.patch
# https://github.com/isc-projects/bind9/commit/238ec379e9bed56383ba2333e711e554b139ac13
Patch238: bind-9.16-CVE-2026-10723.patch
%{?systemd_ordering}
Requires: coreutils
@ -545,6 +547,7 @@ in HTML and PDF format.
%patch235 -p1 -b .CVE-2026-11721
%patch236 -p1 -b .CVE-2026-11622
%patch237 -p1 -b .CVE-2026-13321
%patch238 -p1 -b .CVE-2026-10723
%if %{with PKCS11}
%patch135 -p1 -b .config-pkcs11
@ -1287,6 +1290,10 @@ fi;
%endif
%changelog
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.12
- Fix NSEC3 signer validation (CVE-2026-10723)
- Resolves: RHEL-213499
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.11
- Reject out-of-zone NSEC next owner names (CVE-2026-13321)
- Resolves: RHEL-213313