Fix CVE-2017-13704

dnsmasq-2.77-CVE-2017-13704.patch

@@ -0,0 +1,75 @@
+From 63437ffbb58837b214b4b92cb1c54bc5f3279928 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Wed, 6 Sep 2017 22:34:21 +0100
+Subject: [PATCH] Fix CVE-2017-13704, which resulted in a crash on a large DNS
+ query.
+
+A DNS query recieved by UDP which exceeds 512 bytes (or the EDNS0 packet size,
+if different.) is enough to cause SIGSEGV.
+---
+ src/auth.c    | 5 -----
+ src/forward.c | 8 ++++++++
+ src/rfc1035.c | 5 -----
+ 3 files changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/src/auth.c b/src/auth.c
+index 2c24e16..7f95f98 100644
+--- a/src/auth.c
++++ b/src/auth.c
+@@ -119,11 +119,6 @@ size_t answer_auth(struct dns_header *header, char *limit, size_t qlen, time_t n
+   struct cname *a, *candidate;
+   unsigned int wclen;
+   
+-  /* Clear buffer beyond request to avoid risk of
+-     information disclosure. */
+-  memset(((char *)header) + qlen, 0, 
+-	 (limit - ((char *)header)) - qlen);
+-  
+   if (ntohs(header->qdcount) == 0 || OPCODE(header) != QUERY )
+     return 0;
+ 
+diff --git a/src/forward.c b/src/forward.c
+index f22556a..e3fa94b 100644
+--- a/src/forward.c
++++ b/src/forward.c
+@@ -1188,6 +1188,10 @@ void receive_query(struct listener *listen, time_t now)
+       (msg.msg_flags & MSG_TRUNC) ||
+       (header->hb3 & HB3_QR))
+     return;
++
++  /* Clear buffer beyond request to avoid risk of
++     information disclosure. */
++  memset(daemon->packet + n, 0, daemon->edns_pktsz - n);
+   
+   source_addr.sa.sa_family = listen->family;
+   
+@@ -1688,6 +1692,10 @@ unsigned char *tcp_request(int confd, time_t now,
+   
+       if (size < (int)sizeof(struct dns_header))
+ 	continue;
++
++      /* Clear buffer beyond request to avoid risk of
++	 information disclosure. */
++      memset(payload + size, 0, 65536 - size);
+       
+       query_count++;
+ 
+diff --git a/src/rfc1035.c b/src/rfc1035.c
+index 26f5301..af2fe46 100644
+--- a/src/rfc1035.c
++++ b/src/rfc1035.c
+@@ -1223,11 +1223,6 @@ size_t answer_request(struct dns_header *header, char *limit, size_t qlen,
+   struct mx_srv_record *rec;
+   size_t len;
+ 
+-  /* Clear buffer beyond request to avoid risk of
+-     information disclosure. */
+-  memset(((char *)header) + qlen, 0, 
+-	 (limit - ((char *)header)) - qlen);
+-  
+   if (ntohs(header->ancount) != 0 ||
+       ntohs(header->nscount) != 0 ||
+       ntohs(header->qdcount) == 0 || 
+-- 
+2.9.5
+

dnsmasq.spec

@@ -13,7 +13,7 @@
 
 Name:           dnsmasq
 Version:        2.77
-Release:        6%{?extraversion:.%{extraversion}}%{?dist}
+Release:        7%{?extraversion:.%{extraversion}}%{?dist}
 Summary:        A lightweight DHCP/caching DNS server
 
 Group:          System Environment/Daemons
@@ -141,6 +141,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man1/dhcp_*
 
 %changelog
+* Thu Sep 14 2017 Petr Menšík <pemensik@redhat.com> - 2.77-7
+- Fix CVE-2017-13704
+
 * Mon Aug 14 2017 Petr Menšík <pemensik@redhat.com> - 2.77-6
 - Own the /usr/share/dnsmasq dir (#1480856)