rpms/unbound
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Backport additional fix of locks during initialization

Browse Source 
Use one additional modified fix from the following release.

CVE: CVE-2026-50252
Upstream fix:
 - e597711824
Resolves: RHEL-243471
This commit is contained in:
Petr Menšík 2026-08-19 15:50:51 +02:00
parent 8a81556a94
commit 4d3dd63c03
2 changed files with 68 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
unbound-1.26.0-CVE-2026-50252-fix1.patch Normal file
View File

@ -0,0 +1,61 @@
From a04694c76fc0d9232b1081ad8662809d9211ff85 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Fri, 24 Jul 2026 12:13:09 +0200
Subject: [PATCH] - Fix lock test protect for auth zone change. - Fix to lock
shared_ports structure during initialisation. - Fix to lock anchor structure
when file is set for it in
(cherry picked from commit e597711824e3050fe789f1388766ec5e662684d2)
---
unbound-1.16.2/services/authzone.c | 7 ++++++-
unbound-1.16.2/services/outside_network.c | 7 ++++++-
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/unbound-1.16.2/services/authzone.c b/unbound-1.16.2/services/authzone.c
index cfab17bc0..105391060 100644
--- a/unbound-1.16.2/services/authzone.c
+++ b/unbound-1.16.2/services/authzone.c
@@ -432,7 +432,12 @@ auth_zone_create(struct auth_zones* az, uint8_t* nm, size_t nmlen,
rbtree_init(&z->data, &auth_data_cmp);
lock_rw_init(&z->lock);
lock_protect(&z->lock, &z->name, sizeof(*z)-sizeof(rbnode_type)-
- sizeof(&z->rpz_az_next)-sizeof(&z->rpz_az_prev));
+ sizeof(z->rpz_az_next)-sizeof(z->rpz_az_prev)-
+ sizeof(z->max_transfer_size)-sizeof(z->max_transfer_size));
+ lock_protect(&z->lock, &z->max_transfer_size,
+ sizeof(z->max_transfer_size));
+ lock_protect(&z->lock, &z->max_transfer_time,
+ sizeof(z->max_transfer_time));
lock_rw_wrlock(&z->lock);
/* z lock protects all, except rbtree itself and the rpz linked list
* pointers, which are protected using az->lock */
diff --git a/unbound-1.16.2/services/outside_network.c b/unbound-1.16.2/services/outside_network.c
index 3b9ca68cd..86956fbed 100644
--- a/unbound-1.16.2/services/outside_network.c
+++ b/unbound-1.16.2/services/outside_network.c
@@ -3970,16 +3970,21 @@ struct shared_ports* shared_ports_create(char** ifs, int num_ifs, int do_ip4,
return NULL;
}
lock_basic_init(&shp->lock);
- lock_protect(&shp->lock, shp, sizeof(*shp));
+ lock_protect(&shp->lock, &shp->ip4_ifs, sizeof(shp->ip4_ifs));
+ lock_protect(&shp->lock, &shp->num_ip4, sizeof(shp->num_ip4));
+ lock_protect(&shp->lock, &shp->ip6_ifs, sizeof(shp->ip6_ifs));
+ lock_protect(&shp->lock, &shp->num_ip6, sizeof(shp->num_ip6));
#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
/* Allocate interfaces */
+ lock_basic_lock(&shp->lock);
if(!shared_ports_alloc_ifs(shp, ifs, num_ifs, do_ip4, do_ip6,
availports, numavailports)) {
log_err("malloc failed");
shared_ports_delete(shp);
return NULL;
}
+ lock_basic_unlock(&shp->lock);
#else
(void)ifs; (void)num_ifs; (void)do_ip4; (void)do_ip6;
(void)availports; (void)numavailports;
--
2.55.0

8
unbound.spec
View File

@ -34,7 +34,7 @@
Summary: Validating, recursive, and caching DNS(SEC) resolver
Name: unbound
Version: 1.16.2
Release: 5.14%{?extra_version:.%{extra_version}}%{?dist}.1
Release: 5.14%{?extra_version:.%{extra_version}}%{?dist}.2
License: BSD
Url: https://www.unbound.net/
Source: https://www.unbound.net/downloads/%{name}-%{version}%{?extra_version}.tar.gz
@ -98,6 +98,8 @@ Patch15: unbound-1.25.2-CVE-2026-44690.patch
Patch16: unbound-1.25.2-CVE-2026-44690-test.patch
# https://github.com/NLnetLabs/unbound/commit/804cff4c152a121961b04605f75132370fc80df4
Patch17: unbound-1.25.2-CVE-2026-50252.patch
# https://github.com/NLnetLabs/unbound/commit/e597711824e3050fe789f1388766ec5e662684d2
Patch18: unbound-1.26.0-CVE-2026-50252-fix1.patch
BuildRequires: gdb
@ -215,6 +217,7 @@ pushd %{pkgname}
%patch15 -p1 -b .CVE-2026-44690
%patch16 -p1 -b .CVE-2026-44690-test
%patch17 -p1 -b .CVE-2026-50252
%patch18 -p2 -b .CVE-2026-50252-fix1
# copy common doc files - after here, since it may be patched
cp -pr doc pythonmod libunbound ../
@ -481,6 +484,9 @@ popd
%verify(not md5 size mtime) %{_sharedstatedir}/%{name}/root.key
%changelog
* Wed Aug 19 2026 Petr Menšík <pemensik@redhat.com> - 1.16.2-5.14.2
- Backport additional fix from 1.26.0 (CVE-2026-50252)
* Wed Aug 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.2-5.14.1
- Fix CVE-2026-50252 (cache poisoning via source port prediction)