mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-28 00:50:18 +00:00
Code Issues Projects Releases Wiki Activity

unbound: patch CVE-2026-44608

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44608

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:13:55 +05:30
committed by Anuj Mittal
parent e9a946d263
commit 9af75c4481
2 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-support/unbound/unbound/CVE-2026-44608.patch
+59
View File
@@ -0,0 +1,59 @@
From b70913c1208eda8494e2d6dd81910e92b8640dcc Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 20 May 2026 10:22:52 +0200
Subject: [PATCH] - Fix CVE-2026-44608, Use after free and crash in RPZ code.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
(cherry picked from commit 75b6dba593d4fff000434cd64807c6ebd50bd244)
CVE: CVE-2026-44608
Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/75b6dba593d4fff000434cd64807c6ebd50bd244]
Dropped changes to the Changelog file.
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
services/rpz.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/services/rpz.c b/services/rpz.c
index f45cf6542..27f7de861 100644
--- a/services/rpz.c
+++ b/services/rpz.c
@@ -2468,6 +2468,7 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
{
struct auth_zones* az;
struct auth_zone* a;
+ struct dns_msg* ret = NULL;
struct clientip_synthesized_rr* raddr = NULL;
struct rpz* r = NULL;
struct local_zone* z = NULL;
@@ -2511,13 +2512,11 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
z = rpz_delegation_point_zone_lookup(is->dp, r->nsdname_zones,
is->qchase.qclass, &match);
if(z != NULL) {
- lock_rw_unlock(&a->lock);
break;
}
raddr = rpz_delegation_point_ipbased_trigger_lookup(r, is);
if(raddr != NULL) {
- lock_rw_unlock(&a->lock);
break;
}
lock_rw_unlock(&a->lock);
@@ -2532,9 +2531,12 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
if(z) {
lock_rw_unlock(&z->lock);
}
- return rpz_apply_nsip_trigger(ms, &is->qchase, r, raddr, a);
+ ret = rpz_apply_nsip_trigger(ms, &is->qchase, r, raddr, a);
+ } else {
+ ret = rpz_apply_nsdname_trigger(ms, &is->qchase, r, z, &match, a);
}
- return rpz_apply_nsdname_trigger(ms, &is->qchase, r, z, &match, a);
+ lock_rw_unlock(&a->lock);
+ return ret;
}
struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms,
meta-networking/recipes-support/unbound/unbound_1.24.2.bb
+1
View File
@@ -22,6 +22,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-42923.patch \
file://CVE-2026-42960.patch \
file://CVE-2026-44390.patch \
file://CVE-2026-44608.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"