mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-26 12:20:25 +00:00
Code Issues Projects Releases Wiki Activity

unbound: patch CVE-2026-50046

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-50046

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:13:59 +05:30
committed by Anuj Mittal
parent 5333e61d4f
commit 394ec2adfb
2 changed files with 62 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-support/unbound/unbound/CVE-2026-50046.patch
+61
View File
@@ -0,0 +1,61 @@
From 513f5e4be89d3b139605dfc31c3fb3728f25be2a Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 22 Jul 2026 10:13:36 +0200
Subject: [PATCH] - Fix CVE-2026-50046, Possible heap use-after-free in an
error path when a DoT forwarded query is jostled out. Thanks to Qifan
Zhang, Palo Alto Networks, for the report.
(cherry picked from commit 1ad8d4c39594dcb28d636fb4922737a3640c9a65)
CVE: CVE-2026-50046
Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/1ad8d4c39594dcb28d636fb4922737a3640c9a65]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
services/outside_network.c | 12 +++++++++++-
services/outside_network.h | 2 +-
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/services/outside_network.c b/services/outside_network.c
index 2b7f7d0a2..bc65d36f7 100644
--- a/services/outside_network.c
+++ b/services/outside_network.c
@@ -195,6 +195,7 @@ static void
waiting_tcp_delete(struct waiting_tcp* w)
{
if(!w) return;
+ free(w->tls_auth_name);
if(w->timer)
comm_timer_delete(w->timer);
free(w);
@@ -2489,7 +2490,16 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
w->cb = callback;
w->cb_arg = callback_arg;
w->ssl_upstream = sq->ssl_upstream;
- w->tls_auth_name = sq->tls_auth_name;
+ if(sq->tls_auth_name) {
+ w->tls_auth_name = strdup(sq->tls_auth_name);
+ if(!w->tls_auth_name) {
+ comm_timer_delete(w->timer);
+ free(w);
+ return NULL;
+ }
+ } else {
+ w->tls_auth_name = NULL;
+ }
w->timeout = timeout;
w->id_node.key = NULL;
w->write_wait_prev = NULL;
diff --git a/services/outside_network.h b/services/outside_network.h
index 0a77e3388..81ebfe3e2 100644
--- a/services/outside_network.h
+++ b/services/outside_network.h
@@ -412,7 +412,7 @@ struct waiting_tcp {
void* cb_arg;
/** if it uses ssl upstream */
int ssl_upstream;
- /** ref to the tls_auth_name from the serviced_query */
+ /** owned copy of the tls_auth_name (malloced) */
char* tls_auth_name;
/** the packet was involved in an error, to stop looping errors */
int error_count;
meta-networking/recipes-support/unbound/unbound_1.24.2.bb
+1
View File
@@ -29,6 +29,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-44621.patch \
file://CVE-2026-44687.patch \
file://CVE-2026-50045.patch \
file://CVE-2026-50046.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"