From 3a7ba66d6a03a660693ad3337e134a2c02abbe4f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 6 May 2026 11:00:28 +0200 Subject: [PATCH] Fix broken client subnet validation (CVE-2026-4893) Bug report from Royce M Location: forward.c:713, edns0.c:421 With --add-subnet enabled, process_reply() passes the OPT record length (~23 bytes) instead of the packet length to check_source(). All internal bounds checks fail, and the function always returns 1. ECS source validation per RFC 7871 Section 9.2 is completely bypassed. Resolves-Vulnerability: CVE-2026-4893 Resolves: RHEL-168331 --- dnsmasq-2.93-CVE-2026-4893.patch | 33 ++++++++++++++++++++++++++++++++ dnsmasq.spec | 2 ++ 2 files changed, 35 insertions(+) create mode 100644 dnsmasq-2.93-CVE-2026-4893.patch diff --git a/dnsmasq-2.93-CVE-2026-4893.patch b/dnsmasq-2.93-CVE-2026-4893.patch new file mode 100644 index 0000000..4fdf26c --- /dev/null +++ b/dnsmasq-2.93-CVE-2026-4893.patch @@ -0,0 +1,33 @@ +From a3f7490baf68fc52c839b9257d20f0b35c38cc27 Mon Sep 17 00:00:00 2001 +From: Simon Kelley +Date: Wed, 25 Mar 2026 23:22:37 +0000 +Subject: [PATCH 5/5] Fix broken client subnet validation. CVE-2026-4893 + +Bug report from Royce M + +Location: forward.c:713, edns0.c:421 + +With --add-subnet enabled, process_reply() passes the OPT record +length (~23 bytes) instead of the packet length to check_source(). +All internal bounds checks fail, and the function always returns 1. +ECS source validation per RFC 7871 Section 9.2 is completely bypassed. +--- + src/forward.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/forward.c b/src/forward.c +index 32f37e4..19ff440 100644 +--- a/src/forward.c ++++ b/src/forward.c +@@ -710,7 +710,7 @@ static size_t process_reply(struct dns_header *header, time_t now, struct server + /* Get extended RCODE. */ + rcode |= sizep[2] << 4; + +- if (option_bool(OPT_CLIENT_SUBNET) && !check_source(header, plen, pheader, query_source)) ++ if (option_bool(OPT_CLIENT_SUBNET) && !check_source(header, n, pheader, query_source)) + { + my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch")); + return 0; +-- +2.54.0 + diff --git a/dnsmasq.spec b/dnsmasq.spec index 7e64e5d..550f07d 100644 --- a/dnsmasq.spec +++ b/dnsmasq.spec @@ -53,6 +53,7 @@ Patch5: dnsmasq-2.93-CVE-2026-2291.patch Patch6: dnsmasq-2.93-CVE-2026-4890.patch Patch7: dnsmasq-2.93-CVE-2026-4891.patch Patch8: dnsmasq-2.93-CVE-2026-4892.patch +Patch9: dnsmasq-2.93-CVE-2026-4893.patch Requires: nettle @@ -232,6 +233,7 @@ install -Dpm 644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/%{name}.conf - Prevent DoS in DNSSEC validation (CVE-2026-4890) - Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891) - Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892) +- Prevent source check avoidance by RFC 7871 client-subnet (CVE-2026-4893) * Wed Mar 18 2026 Petr Menšík - 2.90-6 - Prevent heap buffer overflow in cache via NAME_ESCAPE expansion