From a5ed7b915f70243bb56813e238f769892d4d2384 Mon Sep 17 00:00:00 2001 From: pkgagent Date: Thu, 17 Sep 2026 16:18:35 +0800 Subject: [PATCH] =?UTF-8?q?Fix=20CVE-2026-19667:=20reject=20negative=20cac?= =?UTF-8?q?he=20records=20that=20do=20not=20fit=20in=20a=20dns=5Frdata=5Ft?= =?UTF-8?q?=20(0-byte=20negative=E2=80=A6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- bind-9.18.21-CVE-2026-19667.patch | 131 ++++++++++++++++++++++++++++++ bind.spec | 7 +- 2 files changed, 137 insertions(+), 1 deletion(-) create mode 100644 bind-9.18.21-CVE-2026-19667.patch diff --git a/bind-9.18.21-CVE-2026-19667.patch b/bind-9.18.21-CVE-2026-19667.patch new file mode 100644 index 0000000..bd5782b --- /dev/null +++ b/bind-9.18.21-CVE-2026-19667.patch @@ -0,0 +1,131 @@ +From e5c7129b2d312d14759aa8b4a146f78a6a60020e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= +Date: Thu, 6 Aug 2026 17:15:26 +0200 +Subject: [PATCH] Reject negative cache records that do not fit in a + dns_rdata_t + +dns_ncache_add() assembles each negative cache record in a 64 KiB stack +buffer and then stores its size in dns_rdata_t.length, which is 16 bits +wide. A record that fills the buffer exactly is recorded as being zero +bytes long, which is small enough to satisfy the size checks in +dns_rdataslab_fromrdataset() that would otherwise have rejected it. The +truncated record is committed to the cache, and every reader of it then +fails an assertion. + +A response whose authority section repeats one SOA record, with MNAME +and RNAME compressed against a long QNAME, expands to exactly that size, +so check the length where the record is produced rather than relying on +the slab code to notice. Every other way of building a dns_rdata_t +already refuses anything longer than DNS_RDATA_MAXLENGTH. + +While here, refuse a singleton RRset with more than one record and a +second SOA RRset as DNS_R_TOOMANYRECORDS, which is now also what more +than DNS_NCACHE_RDATA records reports instead of ISC_R_NOSPACE. The +message parser and the resolver already reject duplicate singletons +and a second SOA on their own, but dns_ncache_add() should not depend +on its callers for that. + +Co-authored-by: Mark Andrews +(cherry picked from commit 8b20ed0a647cd1e9efc3bf442fc5d898f6a4de57) +Adapted-by: PkgAgent/deepseek-v4 (modified to adapt to opencloudos-stream) +--- + lib/dns/ncache.c | 48 +++++++++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 45 insertions(+), 3 deletions(-) +diff --git a/lib/dns/ncache.c b/lib/dns/ncache.c +index 941574d..6fc7e3f 100644 +--- a/lib/dns/ncache.c ++++ b/lib/dns/ncache.c +@@ -63,14 +63,30 @@ copy_rdataset(dns_rdataset_t *rdataset, isc_buffer_t *buffer) { + return (ISC_R_NOSPACE); + } + count = dns_rdataset_count(rdataset); ++ ++ /* ++ * Reject duplicate singleton records. ++ */ ++ if (dns_rdatatype_issingleton(rdataset->type) && count != 1) { ++ return DNS_R_TOOMANYRECORDS; ++ } ++ + INSIST(count <= 65535); + isc_buffer_putuint16(buffer, (uint16_t)count); + ++ if (ar.length < 2 + count * 2) { ++ /* ++ * The count took 2 bytes and each rdata needs at least 2 ++ * more for its length. Bail early if that cannot fit. ++ */ ++ return ISC_R_NOSPACE; ++ } ++ + result = dns_rdataset_first(rdataset); + while (result == ISC_R_SUCCESS) { + dns_rdataset_current(rdataset, &rdata); + dns_rdata_toregion(&rdata, &r); +- INSIST(r.length <= 65535); ++ INSIST(r.length <= DNS_RDATA_MAXLENGTH); + isc_buffer_availableregion(buffer, &ar); + if (ar.length < 2) { + return (ISC_R_NOSPACE); +@@ -79,6 +95,7 @@ copy_rdataset(dns_rdataset_t *rdataset, isc_buffer_t *buffer) { + * Copy the rdata length to the buffer. + */ + isc_buffer_putuint16(buffer, (uint16_t)r.length); ++ + /* + * Copy the rdata to the buffer. + */ +@@ -129,8 +146,9 @@ addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, + dns_rdata_t rdata[DNS_NCACHE_RDATA]; + dns_rdataset_t ncrdataset; + dns_rdatalist_t ncrdatalist; +- unsigned char data[65536]; ++ unsigned char data[UINT16_MAX]; + unsigned int next = 0; ++ bool seen_soa = false; + + /* + * Convert the authority data from 'message' into a negative cache +@@ -177,6 +195,20 @@ addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, + continue; + } + type = rdataset->type; ++ ++ /* ++ * A negative response carries one SOA ++ * RRset. The resolver rejects a second ++ * one before it gets here; don't rely on ++ * that. ++ */ ++ if (type == dns_rdatatype_soa) { ++ if (seen_soa) { ++ return DNS_R_TOOMANYRECORDS; ++ } ++ seen_soa = true; ++ } ++ + if (type == dns_rdatatype_rrsig) { + type = rdataset->covers; + } +@@ -224,10 +256,20 @@ addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, + } + + if (next >= DNS_NCACHE_RDATA) { +- return (ISC_R_NOSPACE); ++ return DNS_R_TOOMANYRECORDS; + } + dns_rdata_init(&rdata[next]); + isc_buffer_remainingregion(&buffer, &r); ++ /* ++ * dns_rdata_t.length is 16 bits wide, ++ * so a longer record would be silently ++ * truncated here and would then pass ++ * the size checks in ++ * dns_rdataslab_fromrdataset(). ++ */ ++ if (r.length > DNS_RDATA_MAXLENGTH) { ++ return ISC_R_NOSPACE; ++ } + rdata[next].data = r.base; + rdata[next].length = r.length; + rdata[next].rdclass = diff --git a/bind.spec b/bind.spec index 7bc3478..60a08f6 100644 --- a/bind.spec +++ b/bind.spec @@ -6,7 +6,7 @@ Summary: BIND (Berkeley Internet Name Domain), implementation of the Domain Name System (DNS) protocol. Name: bind Version: 9.18.21 -Release: 6%{?dist} +Release: 7%{?dist} License: MPLv2.0 URL: https://www.isc.org/bind/ Source0: https://downloads.isc.org/isc/bind9/%{version}/bind-%{version}.tar.xz @@ -43,6 +43,7 @@ Patch0014: bind-9.18.21-CVE-2026-5946-5.patch Patch0015: bind-9.18.21-CVE-2026-12617.patch Patch0016: bind-9.18.21-CVE-2026-11721-1.patch Patch0017: bind-9.18.21-CVE-2026-11721-2.patch +Patch0018: bind-9.18.21-CVE-2026-19667.patch Patch3000: 3000-CVE-2024-0760.patch Patch3001: 3001-optimize-the-slabheader-placement-for-certain-RRtypes.patch @@ -466,6 +467,10 @@ fi %changelog +* Thu Sep 17 2026 PkgAgent Robot - 9.18.21-7 +- [Type] security +- [DESC] Fix CVE-2026-19667: reject negative cache records that do not fit in a dns_rdata_t (0-byte negative cache entry aborts named) + * Mon Jul 27 2026 PkgAgent Robot - 9.18.21-6 - [Type] security - [DESC] Fix CVE-2026-12617, CVE-2026-11721 -- Gitee