From 5d932adbde50c74daace2e48c15914f5af142a24 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Fri, 11 Sep 2026 11:09:27 +1200 Subject: [PATCH] unbound: patch CVE-2026-55973 Details: https://nvd.nist.gov/vuln/detail/cve-2026-55973 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../unbound/unbound/CVE-2026-55973.patch | 47 +++++++++++++++++++ .../recipes-support/unbound/unbound_1.24.2.bb | 1 + 2 files changed, 48 insertions(+) create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-55973.patch diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-55973.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-55973.patch new file mode 100644 index 0000000000..b463663af4 --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-55973.patch @@ -0,0 +1,47 @@ +From f7511787affcc7f1716f76dcc924c3880fc1f88a Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 22 Jul 2026 10:18:16 +0200 +Subject: [PATCH] - Fix CVE-2026-55973, 'dns-error-reporting: yes' leads to + stack buffer overflow. Thanks to Qifan Zhang, Palo Alto Networks, for the + report. + +(cherry picked from commit 96f875552023c0ccf376ebe050519f12f3371dc9) + +CVE: CVE-2026-55973 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/96f875552023c0ccf376ebe050519f12f3371dc9] + +Signed-off-by: Ankur Tyagi +--- + services/cache/dns.c | 2 ++ + services/mesh.c | 4 ++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/services/cache/dns.c b/services/cache/dns.c +index 121870ee3..cb241c6f9 100644 +--- a/services/cache/dns.c ++++ b/services/cache/dns.c +@@ -259,6 +259,8 @@ find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen, + + /* snip off front label */ + lablen = *qname; ++ if(lablen == 0) ++ break; + qname += lablen + 1; + qnamelen -= lablen + 1; + } +diff --git a/services/mesh.c b/services/mesh.c +index 191b1d488..432063c0d 100644 +--- a/services/mesh.c ++++ b/services/mesh.c +@@ -1620,9 +1620,9 @@ static void dns_error_reporting(struct module_qstate* qstate, + opt = edns_opt_list_find(qstate->edns_opts_back_in, + LDNS_EDNS_REPORT_CHANNEL); + if(!opt) return; +- agent_domain_len = opt->opt_len; + agent_domain = opt->opt_data; +- if(dname_valid(agent_domain, agent_domain_len) < 3) { ++ agent_domain_len = dname_valid(agent_domain, opt->opt_len); ++ if(agent_domain_len < 3) { + /* The agent domain needs to be a valid dname that is not the + * root; from RFC9567. */ + return; diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb index 0af51973cd..b867ea9b73 100644 --- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb +++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb @@ -38,6 +38,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t file://CVE-2026-54478.patch \ file://CVE-2026-55708.patch \ file://CVE-2026-55717.patch \ + file://CVE-2026-55973.patch \ " SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"