mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-09-23 11:21:11 +00:00
Code Issues Projects Releases Wiki Activity

unbound: patch CVE-2026-55990

Browse Source 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55990

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Ankur Tyagi
2026-09-15 10:14:03 +05:30
committed by Anuj Mittal
parent 5d932adbde
commit b18b97d782
2 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-support/unbound/unbound/CVE-2026-55990.patch
+59
View File
@@ -0,0 +1,59 @@
From 6e6c039d23afb169991fa489c2010ab0069a2cab Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Wed, 22 Jul 2026 10:18:41 +0200
Subject: [PATCH] - Fix CVE-2026-55990, Packet of death for a DNSCrypt
misconfigured Unbound. Thanks to Qifan Zhang, Palo Alto Networks, for the
report.
(cherry picked from commit ae1b3810cc3a8eb9b43c378289f74020b42aa7f4)
CVE: CVE-2026-55990
Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/ae1b3810cc3a8eb9b43c378289f74020b42aa7f4]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
dnscrypt/dnscrypt.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/dnscrypt/dnscrypt.c b/dnscrypt/dnscrypt.c
index 173484cdf..bf858361f 100644
--- a/dnscrypt/dnscrypt.c
+++ b/dnscrypt/dnscrypt.c
@@ -663,6 +663,8 @@ dnsc_find_cert(struct dnsc_env* dnscenv, struct sldns_buffer* buffer)
}
dnscrypt_header = (struct dnscrypt_query_header *)sldns_buffer_begin(buffer);
for (i = 0U; i < dnscenv->signed_certs_count; i++) {
+ if(!certs[i].keypair)
+ continue;
if (memcmp(certs[i].magic_query, dnscrypt_header->magic_query,
DNSCRYPT_MAGIC_HEADER_LEN) == 0) {
return &certs[i];
@@ -804,6 +806,7 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
sizeof *env->keypairs);
env->certs = sodium_allocarray(env->signed_certs_count,
sizeof *env->certs);
+ memset(env->certs, 0, env->signed_certs_count * sizeof(*env->certs));
cert_id = 0U;
keypair_id = 0U;
@@ -963,12 +966,19 @@ dnsc_create(void)
int
dnsc_apply_cfg(struct dnsc_env *env, struct config_file *cfg)
{
+ int nkeys;
if(dnsc_parse_certs(env, cfg) <= 0) {
fatal_exit("dnsc_apply_cfg: no cert file loaded");
}
- if(dnsc_parse_keys(env, cfg) <= 0) {
+ nkeys = dnsc_parse_keys(env, cfg);
+ if(nkeys <= 0) {
fatal_exit("dnsc_apply_cfg: no key file loaded");
}
+ if((size_t)nkeys < env->signed_certs_count) {
+ fatal_exit("dnsc_apply_cfg: %u dnscrypt-provider-cert file(s) have no "
+ "matching dnscrypt-secret-key",
+ (unsigned)(env->signed_certs_count - (size_t)nkeys));
+ }
randombytes_buf(env->hash_key, sizeof env->hash_key);
env->provider_name = cfg->dnscrypt_provider;
meta-networking/recipes-support/unbound/unbound_1.24.2.bb
+1
View File
@@ -39,6 +39,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
file://CVE-2026-55708.patch \
file://CVE-2026-55717.patch \
file://CVE-2026-55973.patch \
file://CVE-2026-55990.patch \
"
SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"