rpms/dnsmasq
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix buffer overflow vulnerability in extract_addresses() (CVE-2026-5172)

Browse Source 
Thanks to Hugo Martinez Ray for spotting this.

The value of rdlen for an RR can be a lie, allowing the
call to extract_name() at rfc1025.c:952 to advance the value of p1
past the calculated end of the record. The makes the calculation
of bytes remaining in the RR underflow to a huge number and results
in a massive heap OOB read and certain crash.

Resolves-Vulnerability: CVE-2026-5172
Resolves: RHEL-168349
This commit is contained in:
Petr Menšík 2026-05-06 11:45:23 +02:00
parent 3a7ba66d6a
commit f1dcf6afb2
2 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
dnsmasq-2.93-CVE-2026-5172.patch Normal file
View File

@ -0,0 +1,33 @@
From 9530d9ac81596521c450862a31a95e9025336e59 Mon Sep 17 00:00:00 2001
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Mon, 30 Mar 2026 16:24:33 +0100
Subject: [PATCH] Fix buffer overflow vulnerability in extract_addresses()
CVE-2026-5172
Thanks to Hugo Martinez Ray for spotting this.
The value of rdlen for an RR can be a lie, allowing the
call to extract_name() at rfc1025.c:952 to advance the value of p1
past the calculated end of the record. The makes the calculation
of bytes remaining in the RR underflow to a huge number and results
in a massive heap OOB read and certain crash.
---
src/rfc1035.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/rfc1035.c b/src/rfc1035.c
index ad70f6c..a6fdfe2 100644
--- a/src/rfc1035.c
+++ b/src/rfc1035.c
@@ -932,7 +932,7 @@ int extract_addresses(struct dns_header *header, size_t qlen, char *name, time_t
/* Name, extract it then re-encode. */
int len;
- if (!extract_name(header, qlen, &p1, name, 1, 0))
+ if (!extract_name(header, qlen, &p1, name, 1, 0) || (p1 > endrr))
{
blockdata_free(addr.rrblock.rrdata);
return 2;
--
2.54.0

2
dnsmasq.spec
View File

@ -54,6 +54,7 @@ Patch6: dnsmasq-2.93-CVE-2026-4890.patch
Patch7: dnsmasq-2.93-CVE-2026-4891.patch
Patch8: dnsmasq-2.93-CVE-2026-4892.patch
Patch9: dnsmasq-2.93-CVE-2026-4893.patch
Patch10: dnsmasq-2.93-CVE-2026-5172.patch
Requires: nettle
@ -234,6 +235,7 @@ install -Dpm 644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/%{name}.conf
- Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891)
- Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892)
- Prevent source check avoidance by RFC 7871 client-subnet (CVE-2026-4893)
- Prevent out-of-bounds read in extract_addresses (CVE-2026-5172)
* Wed Mar 18 2026 Petr Menšík <pemensik@redhat.com> - 2.90-6
- Prevent heap buffer overflow in cache via NAME_ESCAPE expansion