rpms/dnsmasq
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Prevent overflow in extract_name function (CVE-2026-2291)

Browse Source 
Handle invalid names correctly and refuse them without writing into too
small buffer. Contains upstream proposed basic fix.

Resolves-Vulnerability: CVE-2026-2291
Resolves: RHEL-181040
This commit is contained in:
Petr Menšík 2026-05-05 17:26:18 +02:00
parent 8ea80e8b0e
commit fcd7e2ba0b
2 changed files with 41 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
dnsmasq-2.93-CVE-2026-2291.patch Normal file
View File

@ -0,0 +1,36 @@
From b8544d5802e56186eb144fbcdd18070b01dc9ab0 Mon Sep 17 00:00:00 2001
From: Simon Kelley <simon@thekelleys.org.uk>
Date: Fri, 10 Apr 2026 16:29:31 +0100
Subject: [PATCH 1/5] Fix buffer overflow in struct bigname. CVE-2026-2291
All buffers capable of holding a domain name should be
at least MAXDNAME*2 + 1 bytes long, where MAXDNAME is the maximum
size of a domain name. The accounts for the trailing zero and the
fact that some characters are escaped in the internal representation
of a domain name in dnsmasq.
The declaration of struct bigname get this wrong, with the effect
that a remote attacker capable of asking DNS queries or answering DNS
queries can cause a large OOB write in the heap.
This was first spotted by Andrew S. Fasano.
---
src/dnsmasq.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/dnsmasq.h b/src/dnsmasq.h
index e455c3f..be8cf2a 100644
--- a/src/dnsmasq.h
+++ b/src/dnsmasq.h
@@ -467,7 +467,7 @@ struct interface_name {
};
union bigname {
- char name[MAXDNAME];
+ char name[(2*MAXDNAME) + 1];
union bigname *next; /* freelist */
};
--
2.54.0

6
dnsmasq.spec
View File

@ -20,7 +20,7 @@
Name: dnsmasq
Version: 2.85
Release: 18%{?extraversion:.%{extraversion}}%{?dist}
Release: 19%{?extraversion:.%{extraversion}}%{?dist}
Summary: A lightweight DHCP/caching DNS server
License: GPLv2 or GPLv3
@ -79,6 +79,7 @@ Patch17: dnsmasq-2.90-CVE-2023-50387-CVE-2023-50868.patch
Patch18: dnsmasq-2.87-filter-AAAA.patch
# http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=5a9eae429a7d0680d606f03f2759d7dde0bbe3f0
Patch19: dnsmasq-2.89-filter-AAAA-improve.patch
Patch20: dnsmasq-2.93-CVE-2026-2291.patch
# This is workaround to nettle bug #1549190
# https://bugzilla.redhat.com/show_bug.cgi?id=1549190
@ -226,6 +227,9 @@ install -Dpm 644 %{SOURCE5} %{buildroot}%{_tmpfilesdir}/%{name}.conf
%{_mandir}/man1/dhcp_*
%changelog
* Tue May 05 2026 Petr Menšík <pemensik@redhat.com> - 2.85-19
- Prevent overflow in extract_name function (CVE-2026-2291)
* Thu Dec 11 2025 Fedor Vorobev <fvorobev@redhat.com> - 2.85-18
- Added installation of tmpfiles config.
- Resolves: RHEL-135305