From 01a0f5e1dd0bb579b4fe331d796cdbce0bb979a7 Mon Sep 17 00:00:00 2001 From: pkgagent Date: Thu, 17 Sep 2026 22:39:35 +0800 Subject: [PATCH] Fix CVE-2026-81642 (heap buffer overflow when digesting DNSKEY in DNSSEC validator) --- unbound-1.17.1-CVE-2026-81642.patch | 24 ++++++++++++++++++++++++ unbound.spec | 7 ++++++- 2 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 unbound-1.17.1-CVE-2026-81642.patch diff --git a/unbound-1.17.1-CVE-2026-81642.patch b/unbound-1.17.1-CVE-2026-81642.patch new file mode 100644 index 0000000..4ab5757 --- /dev/null +++ b/unbound-1.17.1-CVE-2026-81642.patch @@ -0,0 +1,24 @@ +From 8c2e0fd6cc5b6eaa618ac72227808824b4edee7c Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 16 Sep 2026 09:18:49 +0200 +Subject: [PATCH] - Fix CVE-2026-81642, Heap buffer overflow and possible + Remote Code Execution when digesting DNSKEY. Thanks to Yuqi Qiu and Xiang + Li from Nankai University, AOSP Lab for the report. + +--- + validator/val_sigcrypt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c +index 5ab21e2..8ced17a 100644 +--- a/validator/val_sigcrypt.c ++++ b/validator/val_sigcrypt.c +@@ -300,6 +300,8 @@ ds_create_dnskey_digest(struct module_env* env, + * digest = digest_algorithm( DNSKEY owner name | DNSKEY RDATA); + * DNSKEY RDATA = Flags | Protocol | Algorithm | Public Key. */ + sldns_buffer_clear(b); ++ if(!sldns_buffer_available(b, dnskey_rrset->rk.dname_len + dnskey_len-2)) ++ return 0; /* buffer too small */ + sldns_buffer_write(b, dnskey_rrset->rk.dname, + dnskey_rrset->rk.dname_len); + query_dname_tolower(sldns_buffer_begin(b)); diff --git a/unbound.spec b/unbound.spec index 6cc1a2b..4199951 100644 --- a/unbound.spec +++ b/unbound.spec @@ -3,7 +3,7 @@ Summary: Validating, recursive, caching DNS resolver Name: unbound Version: 1.17.1 -Release: 14%{?dist} +Release: 15%{?dist} License: BSD URL: https://nlnetlabs.nl/projects/unbound/ Source0: https://nlnetlabs.nl/downloads/%{name}/%{name}-%{version}.tar.gz @@ -31,6 +31,7 @@ Patch0005: fix-CVE-2025-5994.patch Patch0006: unbound-1.17.1-CVE-2026-42959.patch Patch0007: unbound-1.17.1-CVE-2026-42960.patch Patch0008: unbound-1.17.1-CVE-2026-44690.patch +Patch0009: unbound-1.17.1-CVE-2026-81642.patch Patch3001: backport-pre-CVE-2024-33655-extended_error_encode-for-extended-errors.patch Patch3002: backport-pre-CVE-2024-33655-Downstream-DNS-Cookies-a-la-RFC7873-and-RFC9018.patch @@ -250,6 +251,10 @@ fi %changelog +* Thu Sep 17 2026 PkgAgent Robot - 1.17.1-15 +- [Type] security +- [DESC] Fix CVE-2026-81642 (heap buffer overflow when digesting DNSKEY in DNSSEC validator) + * Mon Jul 27 2026 PkgAgent Robot - 1.17.1-14 - [Type] security - [DESC] Fix CVE-2026-44690 (cross-zone wildcard cache poisoning via RRSIG.labels manipulation) -- Gitee