From 8ad259a937f27841ba40bcf53f8513d939f0c103 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Sun, 27 Sep 2026 13:39:12 +1300 Subject: [PATCH] unbound: patch CVE-2026-81642 Details: https://nvd.nist.gov/vuln/detail/cve-2026-81642 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../unbound/unbound/CVE-2026-81642.patch | 30 +++++++++++++++++++ .../recipes-support/unbound/unbound_1.24.2.bb | 1 + 2 files changed, 31 insertions(+) create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-81642.patch diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-81642.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-81642.patch new file mode 100644 index 0000000000..9f77424a95 --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-81642.patch @@ -0,0 +1,30 @@ +From a774b2050a1543e87def9cba0e25dcdabffde526 Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 16 Sep 2026 09:18:49 +0200 +Subject: [PATCH] - Fix CVE-2026-81642, Heap buffer overflow and possible + Remote Code Execution when digesting DNSKEY. Thanks to Yuqi Qiu and Xiang + Li from Nankai University, AOSP Lab for the report. + +(cherry picked from commit 8c2e0fd6cc5b6eaa618ac72227808824b4edee7c) + +CVE: CVE-2026-81642 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/8c2e0fd6cc5b6eaa618ac72227808824b4edee7c] + +Signed-off-by: Ankur Tyagi +--- + validator/val_sigcrypt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c +index cde281870..b9bfe685c 100644 +--- a/validator/val_sigcrypt.c ++++ b/validator/val_sigcrypt.c +@@ -305,6 +305,8 @@ ds_create_dnskey_digest(struct module_env* env, + * digest = digest_algorithm( DNSKEY owner name | DNSKEY RDATA); + * DNSKEY RDATA = Flags | Protocol | Algorithm | Public Key. */ + sldns_buffer_clear(b); ++ if(!sldns_buffer_available(b, dnskey_rrset->rk.dname_len + dnskey_len-2)) ++ return 0; /* buffer too small */ + sldns_buffer_write(b, dnskey_rrset->rk.dname, + dnskey_rrset->rk.dname_len); + query_dname_tolower(sldns_buffer_begin(b)); diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb index 0b59d7c9f9..c8d7c6cdab 100644 --- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb +++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb @@ -44,6 +44,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t file://CVE-2026-56416.patch \ file://CVE-2026-56444.patch \ file://CVE-2026-80225.patch \ + file://CVE-2026-81642.patch \ " SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"