rpms/dnsmasq
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix broken client subnet validation (CVE-2026-4893)

Browse Source 
Bug report from Royce M <royce@xchglabs.com>

Location: forward.c:713, edns0.c:421

With --add-subnet enabled, process_reply() passes the OPT record
length (~23 bytes) instead of the packet length to check_source().
All internal bounds checks fail, and the function always returns 1.
ECS source validation per RFC 7871 Section 9.2 is completely bypassed.

Resolves-Vulnerability: CVE-2026-4893
Resolves: RHEL-168333
(cherry picked from commit 7479b4aee6bc1ece02d0e6c9f5691d9a803dd2f3)
This commit is contained in:
Petr Menšík 2026-05-06 11:00:28 +02:00
parent 06e01714d9
commit 0f2a592b77
2 changed files with 36 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
dnsmasq-2.93-CVE-2026-4893.patch Normal file
View File

@ -0,0 +1,33 @@
From 4b8388d967e207b277c45e1fc0fb646767e5ca5d Mon Sep 17 00:00:00 2001
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Wed, 25 Mar 2026 23:22:37 +0000
Subject: [PATCH] Fix broken client subnet validation. CVE-2026-4893
Bug report from Royce M <royce@xchglabs.com>
Location: forward.c:713, edns0.c:421
With --add-subnet enabled, process_reply() passes the OPT record
length (~23 bytes) instead of the packet length to check_source().
All internal bounds checks fail, and the function always returns 1.
ECS source validation per RFC 7871 Section 9.2 is completely bypassed.
---
src/forward.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/forward.c b/src/forward.c
index d27f230..156770a 100644
--- a/src/forward.c
+++ b/src/forward.c
@@ -629,7 +629,7 @@ static size_t process_reply(struct dns_header *header, time_t now, struct server
if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign, NULL)))
{
- if (check_subnet && !check_source(header, plen, pheader, query_source))
+ if (check_subnet && !check_source(header, n, pheader, query_source))
{
my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch"));
return 0;
--
2.54.0

3
dnsmasq.spec
View File

@ -111,6 +111,7 @@ Patch49: dnsmasq-2.93-CVE-2026-2291.patch
Patch50: dnsmasq-2.93-CVE-2026-4890.patch
Patch51: dnsmasq-2.93-CVE-2026-4891.patch
Patch52: dnsmasq-2.93-CVE-2026-4892.patch
Patch53: dnsmasq-2.93-CVE-2026-4893.patch
# This is workaround to nettle bug #1549190
# https://bugzilla.redhat.com/show_bug.cgi?id=1549190
@ -196,6 +197,7 @@ server's leases.
%patch50 -p1 -b .CVE-2026-4890
%patch51 -p1 -b .CVE-2026-4891
%patch52 -p1 -b .CVE-2026-4892
%patch53 -p1 -b .CVE-2026-4893
# use /var/lib/dnsmasq instead of /var/lib/misc
for file in dnsmasq.conf.example man/dnsmasq.8 man/es/dnsmasq.8 src/config.h; do
@ -300,6 +302,7 @@ install -Dpm 644 %{SOURCE2} %{buildroot}%{_sysusersdir}/dnsmasq.conf
- Prevent DoS in DNSSEC validation (CVE-2026-4890)
- Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891)
- Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892)
- Prevent source check avoidance by RFC 7871 client-subnet (CVE-2026-4893)
* Mon Aug 18 2025 Tomas Korbar <tkorbar@redhat.com> - 2.79-35
- Fix dnsmasq caching of intertwined CNAMES