From cd2aa18d317313f6b64553e775dd7f8354dca89c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 6 May 2026 10:52:09 +0200 Subject: [PATCH] Verify rdlen field in RRSIG packets (CVE-2026-4891) Resolves-Vulnerability: CVE-2026-4891 Resolves: RHEL-168295 --- dnsmasq-2.93-CVE-2026-4891.patch | 39 ++++++++++++++++++++++++++++++++ dnsmasq.spec | 2 ++ 2 files changed, 41 insertions(+) create mode 100644 dnsmasq-2.93-CVE-2026-4891.patch diff --git a/dnsmasq-2.93-CVE-2026-4891.patch b/dnsmasq-2.93-CVE-2026-4891.patch new file mode 100644 index 0000000..3be3dad --- /dev/null +++ b/dnsmasq-2.93-CVE-2026-4891.patch @@ -0,0 +1,39 @@ +From 2efe6d3acaf840fa06d58b6fad21ad73d0865716 Mon Sep 17 00:00:00 2001 +From: Simon Kelley +Date: Wed, 25 Mar 2026 23:04:08 +0000 +Subject: [PATCH 3/5] Verify rdlen field in RRSIG packets. CVE-2026-4891 + +Bug report from Royce M + +This avoids crafted packets which give a value for rdlen _less_ +then the space taken up by the fixed data and the signer's name +and engender a negative calculated length for the signature. +--- + src/dnssec.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/src/dnssec.c b/src/dnssec.c +index 68f1b5d..d32db5b 100644 +--- a/src/dnssec.c ++++ b/src/dnssec.c +@@ -546,10 +546,14 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in + + *ttl_out = ttl; + } +- ++ ++ /* Don't trust rdlen not to be too small and give us a negative sig_len ++ It has already been checked that it doesn't run us off the end ++ of the packet. */ ++ if ((sig_len = rdlen - (p - psav)) <= 0) ++ return STAT_BOGUS; ++ + sig = p; +- sig_len = rdlen - (p - psav); +- + nsigttl = htonl(orig_ttl); + + hash->update(ctx, 18, psav); +-- +2.54.0 + diff --git a/dnsmasq.spec b/dnsmasq.spec index f5d9f22..97d95f5 100644 --- a/dnsmasq.spec +++ b/dnsmasq.spec @@ -51,6 +51,7 @@ Patch3: dnsmasq-2.78-fips.patch Patch4: dnsmasq-CVE-2026-2291.patch Patch5: dnsmasq-2.93-CVE-2026-2291.patch Patch6: dnsmasq-2.93-CVE-2026-4890.patch +Patch7: dnsmasq-2.93-CVE-2026-4891.patch Requires: nettle @@ -228,6 +229,7 @@ install -Dpm 644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/%{name}.conf * Tue May 05 2026 Petr Menšík - 2.90-7 - Prevent overflow in extract_name function (CVE-2026-2291) - Prevent DoS in DNSSEC validation (CVE-2026-4890) +- Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891) * Wed Mar 18 2026 Petr Menšík - 2.90-6 - Prevent heap buffer overflow in cache via NAME_ESCAPE expansion