mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-26 12:20:25 +00:00
Code Issues Projects Releases Wiki Activity

unbound: patch CVE-2026-40622

Browse Source 
Also backport TTL_IS_EXPIRED macro introduced by commit:
https://github.com/NLnetLabs/unbound/commit/73e408f1d0792267429e9f5f89537cda61297952

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-40622

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:13:53 +05:30
committed by Anuj Mittal
parent e5bdfcd5ed
commit 7e47245343
2 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-support/unbound/unbound/CVE-2026-40622.patch
+58
View File
@@ -0,0 +1,58 @@
From 8711cb40328a6fab85bebb12be0c2948c0752291 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 20 May 2026 10:16:18 +0200
Subject: [PATCH] - Fix CVE-2026-40622, "Ghost domain name" variant. Thanks to
Qifan Zhang, Palo Alto Networks, for the report.
(cherry picked from commit 8d8fa4226613138f5a244a9f1a2506704e049180)
CVE: CVE-2026-40622
Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/8d8fa4226613138f5a244a9f1a2506704e049180]
Dropped changes to the Changelog file.
Also backport TTL_IS_EXPIRED macro introduced by commit:
https://github.com/NLnetLabs/unbound/commit/73e408f1d0792267429e9f5f89537cda61297952
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
services/cache/rrset.c | 10 ++++++++++
util/data/msgparse.h | 4 ++++
2 files changed, 14 insertions(+)
diff --git a/services/cache/rrset.c b/services/cache/rrset.c
index 6d5c24f80..81f4e2820 100644
--- a/services/cache/rrset.c
+++ b/services/cache/rrset.c
@@ -149,6 +149,16 @@ need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
if(equal && cached->ttl >= timenow &&
cached->security == sec_status_bogus)
return 0;
+ /* ghost-domain: never let an NS overwrite extend lifetime
+ * past the entry it replaces, regardless of trust. */
+ if(ns && !TTL_IS_EXPIRED(cached->ttl, timenow) &&
+ newd->ttl > cached->ttl) {
+ size_t i;
+ newd->ttl = cached->ttl;
+ for(i=0; i<(newd->count+newd->rrsig_count); i++)
+ if(newd->rr_ttl[i] > newd->ttl)
+ newd->rr_ttl[i] = newd->ttl;
+ }
return 1;
}
/* o item in cache has expired */
diff --git a/util/data/msgparse.h b/util/data/msgparse.h
index 7de4e394f..9bfe0225d 100644
--- a/util/data/msgparse.h
+++ b/util/data/msgparse.h
@@ -98,6 +98,10 @@ extern time_t SERVE_EXPIRED_REPLY_TTL;
/** If we serve the original TTL or decrementing TTLs */
extern int SERVE_ORIGINAL_TTL;
+/** Check if TTL is expired. 0 TTL is considered expired.
+ * Used mainly to identify parts of the code that do this comparison. */
+#define TTL_IS_EXPIRED(ttl, now) ((ttl) <= (now))
+
/**
* Data stored in scratch pad memory during parsing.
* Stores the data that will enter into the msgreply and packet result.
meta-networking/recipes-support/unbound/unbound_1.24.2.bb
+1
View File
@@ -16,6 +16,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-42944-2.patch \
file://CVE-2026-42959.patch \
file://CVE-2026-32792.patch \
file://CVE-2026-40622.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"