mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-30 00:33:19 +00:00
Code Issues Projects Releases Wiki Activity

dnsmasq: Fix CVE-2026-12969

Browse Source 
This patch applies the upstream fix for CVE-2026-12969 as referenced
in [2], using the upstream commit identified in [1].

[1] https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=14094e88beca519c53151184cc4553656672b54f
[2] https://security-tracker.debian.org/tracker/CVE-2026-12969

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Darsh Kelaiya
2026-07-22 02:49:00 -07:00
committed by Anuj Mittal
parent 1a484a8edd
commit 24202b2e88
2 changed files with 55 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-support/dnsmasq/dnsmasq_2.90.bb
+1
View File
@@ -23,6 +23,7 @@ SRC_URI = "http://www.thekelleys.org.uk/dnsmasq/${@['archive/', ''][float(d.getV
file://CVE-2026-2291.patch \
file://CVE-2026-4890.patch \
file://CVE-2026-12725.patch \
file://CVE-2026-12969.patch \
"
SRC_URI[sha256sum] = "8f6666b542403b5ee7ccce66ea73a4a51cf19dd49392aaccd37231a2c51b303b"
meta-networking/recipes-support/dnsmasq/files/CVE-2026-12969.patch
+54
View File
@@ -0,0 +1,54 @@
From bfac6db25b92b65d9d2f013534e7ebc265fec267 Mon Sep 17 00:00:00 2001
From: do litli <dolitli02@gmail.com>
Date: Sat, 9 May 2026 22:21:18 +0100
Subject: [PATCH] Fix buffer OOB read in find_soa()
In find_soa() extract_name() is called with extrabytes=0 when parsing NS
record names, which means it only validates that the DNS name fits
within the packet but does not check that 10 additional bytes exist for
the type/class/TTL/rdlen fixed fields. Lines 546-549 then
unconditionally read these 10 bytes via GETSHORT/GETLONG macros. An
attacker controlling a DNS zone can craft a NXDOMAIN response where the
NS record name extends to the packet boundary, causing a 10-byte
out-of-bounds read past the valid packet data (CWE-125, CVSS 5.3
Medium). The read stays within the over-allocated packet buffer in
default configurations, limiting crash risk, but accesses data outside
the logical packet boundary. Under certain conditions, the overread may
access stale heap data from prior transactions.
The fix is straightforward: change the extrabytes
argument from 0 to 10, consistent with other call sites in
the same file.
Credit is due to do litli for finding this problem.
CVE: CVE-2026-12969
Upstream-Status: Backport [https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=14094e88beca519c53151184cc4553656672b54f]
Backport Changes:
- dnsmasq 2.90 predates the EXTR_NAME_EXTRACT constant and uses the
boolean isExtract argument. Retain 1 for this argument and backport
only the security-relevant extrabytes change from 0 to 10.
(cherry picked from commit 14094e88beca519c53151184cc4553656672b54f)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
src/rfc1035.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/rfc1035.c b/src/rfc1035.c
index 32dc571..8b00eb2 100644
--- a/src/rfc1035.c
+++ b/src/rfc1035.c
@@ -480,7 +480,7 @@ static int find_soa(struct dns_header *header, size_t qlen, char *name, int *sub
for (i = 0; i < ntohs(header->nscount); i++)
{
- if (!extract_name(header, qlen, &p, daemon->workspacename, 1, 0))
+ if (!extract_name(header, qlen, &p, daemon->workspacename, 1, 10))
return 0; /* bad packet */
GETSHORT(qtype, p);
--
2.44.4