rpms/dnsmasq
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix broken client subnet validation (CVE-2026-4893)

Browse Source 
Bug report from Royce M <royce@xchglabs.com>

Location: forward.c:713, edns0.c:421

With --add-subnet enabled, process_reply() passes the OPT record
length (~23 bytes) instead of the packet length to check_source().
All internal bounds checks fail, and the function always returns 1.
ECS source validation per RFC 7871 Section 9.2 is completely bypassed.

Resolves-Vulnerability: CVE-2026-4893
Resolves: RHEL-168331
This commit is contained in:
Petr Menšík 2026-05-06 11:00:28 +02:00
parent 2bcf829f3a
commit 3a7ba66d6a
2 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
dnsmasq-2.93-CVE-2026-4893.patch Normal file
View File

@ -0,0 +1,33 @@
From a3f7490baf68fc52c839b9257d20f0b35c38cc27 Mon Sep 17 00:00:00 2001
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Wed, 25 Mar 2026 23:22:37 +0000
Subject: [PATCH 5/5] Fix broken client subnet validation. CVE-2026-4893
Bug report from Royce M <royce@xchglabs.com>
Location: forward.c:713, edns0.c:421
With --add-subnet enabled, process_reply() passes the OPT record
length (~23 bytes) instead of the packet length to check_source().
All internal bounds checks fail, and the function always returns 1.
ECS source validation per RFC 7871 Section 9.2 is completely bypassed.
---
src/forward.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/forward.c b/src/forward.c
index 32f37e4..19ff440 100644
--- a/src/forward.c
+++ b/src/forward.c
@@ -710,7 +710,7 @@ static size_t process_reply(struct dns_header *header, time_t now, struct server
/* Get extended RCODE. */
rcode |= sizep[2] << 4;
- if (option_bool(OPT_CLIENT_SUBNET) && !check_source(header, plen, pheader, query_source))
+ if (option_bool(OPT_CLIENT_SUBNET) && !check_source(header, n, pheader, query_source))
{
my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch"));
return 0;
--
2.54.0

2
dnsmasq.spec
View File

@ -53,6 +53,7 @@ Patch5: dnsmasq-2.93-CVE-2026-2291.patch
Patch6: dnsmasq-2.93-CVE-2026-4890.patch
Patch7: dnsmasq-2.93-CVE-2026-4891.patch
Patch8: dnsmasq-2.93-CVE-2026-4892.patch
Patch9: dnsmasq-2.93-CVE-2026-4893.patch
Requires: nettle
@ -232,6 +233,7 @@ install -Dpm 644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/%{name}.conf
- Prevent DoS in DNSSEC validation (CVE-2026-4890)
- Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891)
- Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892)
- Prevent source check avoidance by RFC 7871 client-subnet (CVE-2026-4893)
* Wed Mar 18 2026 Petr Menšík <pemensik@redhat.com> - 2.90-6
- Prevent heap buffer overflow in cache via NAME_ESCAPE expansion