diff mbox series

[meta-networking,wrynose,18/25] dnsmasq: fix CVE-2026-4890

Message ID 20260523050028.848327-18-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-gnome,wrynose,1/25] localsearch: upgrade 3.11.0 -> 3.11.1 | expand

Commit Message

Ankur Tyagi May 23, 2026, 5 a.m. UTC 
From: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>

A Denial of Service (DoS) vulnerability in the DNSSEC
validation of dnsmasq allows remote attackers to cause
a denial of service via a crafted DNS packet.

Reference:
[ https://nvd.nist.gov/vuln/detail/CVE-2026-4890 ]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 78162615f538ddfde6886f1dc2a8c7d3d944c79e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../recipes-support/dnsmasq/dnsmasq_2.92.bb   |  1 +
 .../dnsmasq/files/CVE-2026-4890.patch         | 50 +++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 meta-networking/recipes-support/dnsmasq/files/CVE-2026-4890.patch
diff mbox series

Patch

diff --git a/meta-networking/recipes-support/dnsmasq/dnsmasq_2.92.bb b/meta-networking/recipes-support/dnsmasq/dnsmasq_2.92.bb
index bef058aa3e..61cdccb241 100644
--- a/meta-networking/recipes-support/dnsmasq/dnsmasq_2.92.bb
+++ b/meta-networking/recipes-support/dnsmasq/dnsmasq_2.92.bb
@@ -16,6 +16,7 @@  SRC_URI = "http://www.thekelleys.org.uk/dnsmasq/${@['archive/', ''][float(d.getV
            file://dnsmasq-noresolvconf.service \
            file://dnsmasq-resolved.conf \
            file://CVE-2026-2291.patch \
+           file://CVE-2026-4890.patch \
 "
 SRC_URI[sha256sum] = "fd908e79ff37f73234afcb6d3363f78353e768703d92abd8e3220ade6819b1e1"
 
diff --git a/meta-networking/recipes-support/dnsmasq/files/CVE-2026-4890.patch b/meta-networking/recipes-support/dnsmasq/files/CVE-2026-4890.patch
new file mode 100644
index 0000000000..4a7673817b
--- /dev/null
+++ b/meta-networking/recipes-support/dnsmasq/files/CVE-2026-4890.patch
@@ -0,0 +1,50 @@ 
+commit 4fdb707633afe8028118bcaf39b4882f634b5999
+Author: Simon Kelley <simon@thekelleys.org.uk>
+Date:   Fri Apr 10 16:24:02 2026 +0100
+
+Fix NSEC bitmap parsing infinite loop. CVE-2026-4890
+    
+Report from Royce M <royce@xchglabs.com>.
+    
+Location: dnssec.c:1290-1306, dnssec.c:1450-1463
+    
+The bitmap window iteration advances by p[1] instead of p[1]+2
+(missing the 2-byte window header). With bitmap_length=0, both rdlen and p are
+unchanged, causing an infinite loop and dnsmasq stops responding to all queries.
+    
+Reachable before RRSIG validation
+(confirmed by the source comment at line 2125), so no valid
+DNSSEC signatures are needed.
+
+CVE: CVE-2026-4890
+
+Upstream-Status: Backport [ https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=7b151eb60609a0139474918222806f9bcfb4fe71 ]
+
+Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
+
+diff --git a/src/dnssec.c b/src/dnssec.c
+index 4bb0495..3951620 100644
+--- a/src/dnssec.c
++++ b/src/dnssec.c
+@@ -1348,8 +1348,8 @@ static int prove_non_existence_nsec(struct dns_header *header, size_t plen, unsi
+ 		  break; /* finished checking */
+ 		}
+ 	      
+-	      rdlen -= p[1];
+-	      p +=  p[1];
++	      rdlen -= p[1] + 2;
++	      p +=  p[1] + 2;
+ 	    }
+ 	  
+ 	  return 0;
+@@ -1512,8 +1512,8 @@ static int check_nsec3_coverage(struct dns_header *header, size_t plen, int dige
+ 			break; /* finished checking */
+ 		      }
+ 		    
+-		    rdlen -= p[1];
+-		    p +=  p[1];
++		    rdlen -= p[1] + 2;
++		    p +=  p[1] + 2;
+ 		  }
+ 		
+ 		return 1;