From f1dcf6afb2d2185b734fb06f5e1baa53046a93f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 6 May 2026 11:45:23 +0200 Subject: [PATCH] Fix buffer overflow vulnerability in extract_addresses() (CVE-2026-5172) Thanks to Hugo Martinez Ray for spotting this. The value of rdlen for an RR can be a lie, allowing the call to extract_name() at rfc1025.c:952 to advance the value of p1 past the calculated end of the record. The makes the calculation of bytes remaining in the RR underflow to a huge number and results in a massive heap OOB read and certain crash. Resolves-Vulnerability: CVE-2026-5172 Resolves: RHEL-168349 --- dnsmasq-2.93-CVE-2026-5172.patch | 33 ++++++++++++++++++++++++++++++++ dnsmasq.spec | 2 ++ 2 files changed, 35 insertions(+) create mode 100644 dnsmasq-2.93-CVE-2026-5172.patch diff --git a/dnsmasq-2.93-CVE-2026-5172.patch b/dnsmasq-2.93-CVE-2026-5172.patch new file mode 100644 index 0000000..4a9d188 --- /dev/null +++ b/dnsmasq-2.93-CVE-2026-5172.patch @@ -0,0 +1,33 @@ +From 9530d9ac81596521c450862a31a95e9025336e59 Mon Sep 17 00:00:00 2001 +From: Simon Kelley +Date: Mon, 30 Mar 2026 16:24:33 +0100 +Subject: [PATCH] Fix buffer overflow vulnerability in extract_addresses() + CVE-2026-5172 + +Thanks to Hugo Martinez Ray for spotting this. + +The value of rdlen for an RR can be a lie, allowing the +call to extract_name() at rfc1025.c:952 to advance the value of p1 +past the calculated end of the record. The makes the calculation +of bytes remaining in the RR underflow to a huge number and results +in a massive heap OOB read and certain crash. +--- + src/rfc1035.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/rfc1035.c b/src/rfc1035.c +index ad70f6c..a6fdfe2 100644 +--- a/src/rfc1035.c ++++ b/src/rfc1035.c +@@ -932,7 +932,7 @@ int extract_addresses(struct dns_header *header, size_t qlen, char *name, time_t + /* Name, extract it then re-encode. */ + int len; + +- if (!extract_name(header, qlen, &p1, name, 1, 0)) ++ if (!extract_name(header, qlen, &p1, name, 1, 0) || (p1 > endrr)) + { + blockdata_free(addr.rrblock.rrdata); + return 2; +-- +2.54.0 + diff --git a/dnsmasq.spec b/dnsmasq.spec index 550f07d..9dd0b7a 100644 --- a/dnsmasq.spec +++ b/dnsmasq.spec @@ -54,6 +54,7 @@ Patch6: dnsmasq-2.93-CVE-2026-4890.patch Patch7: dnsmasq-2.93-CVE-2026-4891.patch Patch8: dnsmasq-2.93-CVE-2026-4892.patch Patch9: dnsmasq-2.93-CVE-2026-4893.patch +Patch10: dnsmasq-2.93-CVE-2026-5172.patch Requires: nettle @@ -234,6 +235,7 @@ install -Dpm 644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/%{name}.conf - Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891) - Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892) - Prevent source check avoidance by RFC 7871 client-subnet (CVE-2026-4893) +- Prevent out-of-bounds read in extract_addresses (CVE-2026-5172) * Wed Mar 18 2026 Petr Menšík - 2.90-6 - Prevent heap buffer overflow in cache via NAME_ESCAPE expansion