rpms/dnsmasq
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Verify rdlen field in RRSIG packets (CVE-2026-4891)

Browse Source 
Resolves-Vulnerability: CVE-2026-4891
Resolves: RHEL-168295
This commit is contained in:
Petr Menšík 2026-05-06 10:52:09 +02:00
parent e7eb721b3a
commit cd2aa18d31
2 changed files with 41 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
dnsmasq-2.93-CVE-2026-4891.patch Normal file
View File

@ -0,0 +1,39 @@
From 2efe6d3acaf840fa06d58b6fad21ad73d0865716 Mon Sep 17 00:00:00 2001
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Wed, 25 Mar 2026 23:04:08 +0000
Subject: [PATCH 3/5] Verify rdlen field in RRSIG packets. CVE-2026-4891
Bug report from Royce M <royce@xchglabs.com>
This avoids crafted packets which give a value for rdlen _less_
then the space taken up by the fixed data and the signer's name
and engender a negative calculated length for the signature.
---
src/dnssec.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/src/dnssec.c b/src/dnssec.c
index 68f1b5d..d32db5b 100644
--- a/src/dnssec.c
+++ b/src/dnssec.c
@@ -546,10 +546,14 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
*ttl_out = ttl;
}
-
+
+ /* Don't trust rdlen not to be too small and give us a negative sig_len
+ It has already been checked that it doesn't run us off the end
+ of the packet. */
+ if ((sig_len = rdlen - (p - psav)) <= 0)
+ return STAT_BOGUS;
+
sig = p;
- sig_len = rdlen - (p - psav);
-
nsigttl = htonl(orig_ttl);
hash->update(ctx, 18, psav);
--
2.54.0

2
dnsmasq.spec
View File

@ -51,6 +51,7 @@ Patch3: dnsmasq-2.78-fips.patch
Patch4: dnsmasq-CVE-2026-2291.patch
Patch5: dnsmasq-2.93-CVE-2026-2291.patch
Patch6: dnsmasq-2.93-CVE-2026-4890.patch
Patch7: dnsmasq-2.93-CVE-2026-4891.patch
Requires: nettle
@ -228,6 +229,7 @@ install -Dpm 644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/%{name}.conf
* Tue May 05 2026 Petr Menšík <pemensik@redhat.com> - 2.90-7
- Prevent overflow in extract_name function (CVE-2026-2291)
- Prevent DoS in DNSSEC validation (CVE-2026-4890)
- Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891)
* Wed Mar 18 2026 Petr Menšík <pemensik@redhat.com> - 2.90-6
- Prevent heap buffer overflow in cache via NAME_ESCAPE expansion