From 86102be48e5e754d14b60bec4785e93d208ef772 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Sat, 25 Jul 2026 10:02:10 +0000 Subject: [PATCH] Fix CVE-2026-10723: NSEC3 signer validation Backport upstream fix for CVE-2026-10723 which validates that NSEC3 record signers match the owning zone. This prevents a child zone from impersonating its parent and forging NXDOMAIN responses for sibling domains. The patch adds signer validation in lib/dns/dnssec.c and updates the NSEC3 error description string in lib/isc/result.c. CVE: CVE-2026-10723 Upstream patches: - https://github.com/isc-projects/bind9/commit/c9cb6a5e24e43489cf3fd4d4cc2193b6a74499cb.patch Resolves: RHEL-213500 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- bind-9.18-CVE-2026-10723.patch | 63 ++++++++++++++++++++++++++++++++++ bind9.18.spec | 7 +++- 2 files changed, 69 insertions(+), 1 deletion(-) create mode 100644 bind-9.18-CVE-2026-10723.patch diff --git a/bind-9.18-CVE-2026-10723.patch b/bind-9.18-CVE-2026-10723.patch new file mode 100644 index 0000000..bb74af2 --- /dev/null +++ b/bind-9.18-CVE-2026-10723.patch @@ -0,0 +1,63 @@ +From a33a4a00c77eeeeac1eed7e87ea1811dc7fa713b Mon Sep 17 00:00:00 2001 +From: Evan Hunt +Date: Thu, 21 May 2026 14:41:55 -0700 +Subject: [PATCH] Check NSEC3 signer matches the owning zone + +When validating NSEC3 records, reject any signature whose signer field +does not match the zone owning the NSEC3. + +This ensures that a child zone cannot impersonate its parent and forge +NXDOMAIN responses for sibling domains. + +Fixes: isc-projects/bind9#5874 +(cherry picked from commit 6e5066bb1f0f12d090e8707adb7d6ccf74f8012b) +--- + lib/dns/dnssec.c | 19 +++++++++++++++++-- + lib/isc/result.c | 2 +- + 2 files changed, 18 insertions(+), 3 deletions(-) + +diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c +index cc31f9511a..d68c96920b 100644 +--- a/lib/dns/dnssec.c ++++ b/lib/dns/dnssec.c +@@ -424,10 +424,25 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + } + + /* +- * NS, SOA and DNSSKEY records are signed by their owner. +- * DS records are signed by the parent. ++ * NS, SOA and DNSKEY records are signed by their owners. ++ * NSEC3 records are signed by the apex, exactly one level up ++ * from their owner names. ++ * DS records are signed by the parent zone. + */ + switch (set->type) { ++ case dns_rdatatype_nsec3: { ++ dns_name_t apex = DNS_NAME_INITEMPTY; ++ labels = dns_name_countlabels(name); ++ if (labels <= 1) { ++ inc_stat(dns_dnssecstats_fail); ++ return DNS_R_INVALIDNSEC3; ++ } ++ dns_name_split(name, labels - 1, NULL, &apex); ++ if (!dns_name_equal(&apex, &sig.signer)) { ++ inc_stat(dns_dnssecstats_fail); ++ return DNS_R_SIGINVALID; ++ } ++ } break; + case dns_rdatatype_ns: + case dns_rdatatype_soa: + case dns_rdatatype_dnskey: +diff --git a/lib/isc/result.c b/lib/isc/result.c +index edbc8fd518..bdbf563138 100644 +--- a/lib/isc/result.c ++++ b/lib/isc/result.c +@@ -198,7 +198,7 @@ static const char *description[ISC_R_NRESULTS] = { + [DNS_R_COVERINGNSEC] = "covering NSEC record returned", + [DNS_R_MXISADDRESS] = "MX is an address", + [DNS_R_DUPLICATE] = "duplicate query", +- [DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name (wildcard)", ++ [DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name", + [DNS_R_NOTPRIMARY] = "not primary", + [DNS_R_BROKENCHAIN] = "broken trust chain", + [DNS_R_EXPIRED] = "expired", diff --git a/bind9.18.spec b/bind9.18.spec index 822c7f3..577b6a4 100644 --- a/bind9.18.spec +++ b/bind9.18.spec @@ -75,7 +75,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 Version: 9.18.29 -Release: 22%{?dist} +Release: 23%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -168,6 +168,8 @@ Patch239: bind-9.18-CVE-2026-11622.patch # https://github.com/isc-projects/bind9/commit/058023c66f11d78590d4aa8c4f98946c4c965e21 # https://github.com/isc-projects/bind9/commit/f751e19a30d107f04c2f644aff9f8dab8fed03ab Patch240: bind-9.18-CVE-2026-13321.patch +# https://github.com/isc-projects/bind9/commit/c9cb6a5e24e43489cf3fd4d4cc2193b6a74499cb +Patch241: bind-9.18-CVE-2026-10723.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -1031,6 +1033,9 @@ fi; %endif %changelog +* Sat Jul 25 2026 RHEL Packaging Agent - 32:9.18.29-23 +- Fix NSEC3 signer validation (CVE-2026-10723) + * Fri Jul 24 2026 RHEL Packaging Agent - 32:9.18.29-22 - Reject out-of-zone NSEC next owner names (CVE-2026-13321)