mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-23 11:21:11 +00:00
Code Issues Projects Releases Wiki Activity

unbound: patch CVE-2026-56416

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-56416

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:14:04 +05:30
committed by Anuj Mittal
parent 5401a83771
commit b03acb631b
2 changed files with 69 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-support/unbound/unbound/CVE-2026-56416.patch
+68
View File
@@ -0,0 +1,68 @@
From 984cbdd8761685087f1e20d6e9d9da12d7412916 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 22 Jul 2026 10:19:28 +0200
Subject: [PATCH] - Fix CVE-2026-56416, Possible heap buffer overflow when
validator canonicalizes RDATA that contains domain name. Thanks to Qifan
Zhang, Palo Alto Networks, for the report.
(cherry picked from commit 4b1635e19406fd8040806f0fa4a4488c003b5d0d)
CVE: CVE-2026-56416
Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/4b1635e19406fd8040806f0fa4a4488c003b5d0d]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
util/data/msgparse.c | 3 +++
validator/val_sigcrypt.c | 11 +++++++----
2 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/util/data/msgparse.c b/util/data/msgparse.c
index 3dc2e1264..9d3ddda7a 100644
--- a/util/data/msgparse.c
+++ b/util/data/msgparse.c
@@ -687,6 +687,9 @@ calc_size(sldns_buffer* pkt, uint16_t type, struct rr_parse* rr)
}
rdf++;
}
+ /* rdata ended before all _dname_count names were seen */
+ if(count != 0)
+ return 0; /* the rdata is too short. */
}
/* remaining rdata */
rr->size += pkt_len;
diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c
index 86de6fb8e..cde281870 100644
--- a/validator/val_sigcrypt.c
+++ b/validator/val_sigcrypt.c
@@ -1094,6 +1094,7 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
size_t len)
{
uint8_t* datstart = sldns_buffer_current(buf)-len+2;
+ size_t firstlen;
switch(ntohs(rrset->rk.type)) {
case LDNS_RR_TYPE_NXT:
case LDNS_RR_TYPE_NS:
@@ -1113,8 +1114,9 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
case LDNS_RR_TYPE_SOA:
/* two names after another */
query_dname_tolower(datstart);
- query_dname_tolower(datstart +
- dname_valid(datstart, len-2));
+ firstlen = dname_valid(datstart, len-2);
+ if(firstlen && firstlen < len-2)
+ query_dname_tolower(datstart + firstlen);
return;
case LDNS_RR_TYPE_RT:
case LDNS_RR_TYPE_AFSDB:
@@ -1141,8 +1143,9 @@ canonicalize_rdata(sldns_buffer* buf, struct ub_packed_rrset_key* rrset,
return;
datstart += 2;
query_dname_tolower(datstart);
- query_dname_tolower(datstart +
- dname_valid(datstart, len-2-2));
+ firstlen = dname_valid(datstart, len-2-2);
+ if(firstlen && firstlen < len-2-2)
+ query_dname_tolower(datstart + firstlen);
return;
case LDNS_RR_TYPE_NAPTR:
if(len < 2+4)
meta-networking/recipes-support/unbound/unbound_1.24.2.bb
+1
View File
@@ -41,6 +41,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-55973.patch \
file://CVE-2026-55990.patch \
file://CVE-2026-55991.patch \
file://CVE-2026-56416.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"