From fd05d77e873b1a532ea543775c03072034704340 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 16 May 2023 06:06:06 +0000 Subject: [PATCH] import bind9.16-9.16.23-0.14.el8 --- SOURCES/bind-9.16-CVE-2022-2795.patch | 60 +++ SOURCES/bind-9.16-CVE-2022-3094-1.patch | 240 +++++++++++ SOURCES/bind-9.16-CVE-2022-3094-2.patch | 266 ++++++++++++ SOURCES/bind-9.16-CVE-2022-3094-3.patch | 470 +++++++++++++++++++++ SOURCES/bind-9.16-CVE-2022-3094-test.patch | 272 ++++++++++++ SOURCES/bind-9.16-CVE-2022-3736.patch | 53 +++ SOURCES/bind-9.16-CVE-2022-3924.patch | 128 ++++++ SPECS/bind9.16.spec | 37 +- 8 files changed, 1524 insertions(+), 2 deletions(-) create mode 100644 SOURCES/bind-9.16-CVE-2022-2795.patch create mode 100644 SOURCES/bind-9.16-CVE-2022-3094-1.patch create mode 100644 SOURCES/bind-9.16-CVE-2022-3094-2.patch create mode 100644 SOURCES/bind-9.16-CVE-2022-3094-3.patch create mode 100644 SOURCES/bind-9.16-CVE-2022-3094-test.patch create mode 100644 SOURCES/bind-9.16-CVE-2022-3736.patch create mode 100644 SOURCES/bind-9.16-CVE-2022-3924.patch diff --git a/SOURCES/bind-9.16-CVE-2022-2795.patch b/SOURCES/bind-9.16-CVE-2022-2795.patch new file mode 100644 index 0000000..b67c8e9 --- /dev/null +++ b/SOURCES/bind-9.16-CVE-2022-2795.patch @@ -0,0 +1,60 @@ +From bf2ea6d8525bfd96a84dad221ba9e004adb710a8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= +Date: Thu, 8 Sep 2022 11:11:30 +0200 +Subject: [PATCH] Bound the amount of work performed for delegations + +Limit the amount of database lookups that can be triggered in +fctx_getaddresses() (i.e. when determining the name server addresses to +query next) by setting a hard limit on the number of NS RRs processed +for any delegation encountered. Without any limit in place, named can +be forced to perform large amounts of database lookups per each query +received, which severely impacts resolver performance. + +The limit used (20) is an arbitrary value that is considered to be big +enough for any sane DNS delegation. + +(cherry picked from commit 3a44097fd6c6c260765b628cd1d2c9cb7efb0b2a) +--- + lib/dns/resolver.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c +index d2cf14bbc8..73a0ee9f77 100644 +--- a/lib/dns/resolver.c ++++ b/lib/dns/resolver.c +@@ -195,6 +195,12 @@ + */ + #define NS_FAIL_LIMIT 4 + #define NS_RR_LIMIT 5 ++/* ++ * IP address lookups are performed for at most NS_PROCESSING_LIMIT NS RRs in ++ * any NS RRset encountered, to avoid excessive resource use while processing ++ * large delegations. ++ */ ++#define NS_PROCESSING_LIMIT 20 + + /* Number of hash buckets for zone counters */ + #ifndef RES_DOMAIN_BUCKETS +@@ -3711,6 +3717,7 @@ fctx_getaddresses(fetchctx_t *fctx, bool badcache) { + bool need_alternate = false; + bool all_spilled = true; + unsigned int no_addresses = 0; ++ unsigned int ns_processed = 0; + + FCTXTRACE5("getaddresses", "fctx->depth=", fctx->depth); + +@@ -3902,6 +3909,11 @@ normal_nses: + + dns_rdata_reset(&rdata); + dns_rdata_freestruct(&ns); ++ ++ if (++ns_processed >= NS_PROCESSING_LIMIT) { ++ result = ISC_R_NOMORE; ++ break; ++ } + } + if (result != ISC_R_NOMORE) { + return (result); +-- +2.37.3 + diff --git a/SOURCES/bind-9.16-CVE-2022-3094-1.patch b/SOURCES/bind-9.16-CVE-2022-3094-1.patch new file mode 100644 index 0000000..86fbf76 --- /dev/null +++ b/SOURCES/bind-9.16-CVE-2022-3094-1.patch @@ -0,0 +1,240 @@ +From 18036bb3f435eaa20d60093738c61e5da42a6cfe Mon Sep 17 00:00:00 2001 +From: Evan Hunt +Date: Thu, 1 Sep 2022 16:05:04 -0700 +Subject: [PATCH] add an update quota + +limit the number of simultaneous DNS UPDATE events that can be +processed by adding a quota for update and update forwarding. +this quota currently, arbitrarily, defaults to 100. + +also add a statistics counter to record when the update quota +has been exceeded. + +(cherry picked from commit 7c47254a140c3e9cf383cda73c7b6a55c4782826) +--- + bin/named/bind9.xsl | 4 +++- + bin/named/bind9.xsl.h | 6 +++++- + bin/named/statschannel.c | 5 +++-- + doc/arm/reference.rst | 5 +++++ + lib/ns/include/ns/server.h | 1 + + lib/ns/include/ns/stats.h | 4 +++- + lib/ns/server.c | 2 ++ + lib/ns/update.c | 37 ++++++++++++++++++++++++++++++++++++- + 8 files changed, 58 insertions(+), 6 deletions(-) + +diff --git a/bin/named/bind9.xsl b/bin/named/bind9.xsl +index 5078115..194625b 100644 +--- a/bin/named/bind9.xsl ++++ b/bin/named/bind9.xsl +@@ -12,7 +12,9 @@ + + + +- ++ ++ ++ + + + +diff --git a/bin/named/bind9.xsl.h b/bin/named/bind9.xsl.h +index e30f7f5..b182742 100644 +--- a/bin/named/bind9.xsl.h ++++ b/bin/named/bind9.xsl.h +@@ -20,7 +20,11 @@ static char xslmsg[] = + "\n" + " \n" +- " \n" ++ " \n" ++ " \n" ++ " \n" + " \n" + " \n" + "