diff mbox series

[meta-networking,scarthgap,2/2] dnsmasq: Fix CVE-2026-12969

Message ID 20260722094900.1399727-2-dkelaiya@cisco.com
State New
Headers show
Series [meta-networking,scarthgap,1/2] dnsmasq: Fix CVE-2026-12725 | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) July 22, 2026, 9:49 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

This patch applies the upstream fix for CVE-2026-12969 as referenced
in [2], using the upstream commit identified in [1].

[1] https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=14094e88beca519c53151184cc4553656672b54f
[2] https://security-tracker.debian.org/tracker/CVE-2026-12969

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 .../recipes-support/dnsmasq/dnsmasq_2.90.bb   |  1 +
 .../dnsmasq/files/CVE-2026-12969.patch        | 54 +++++++++++++++++++
 2 files changed, 55 insertions(+)
 create mode 100644 meta-networking/recipes-support/dnsmasq/files/CVE-2026-12969.patch
diff mbox series

Patch

diff --git a/meta-networking/recipes-support/dnsmasq/dnsmasq_2.90.bb b/meta-networking/recipes-support/dnsmasq/dnsmasq_2.90.bb
index c25c25a447..f1e13af890 100644
--- a/meta-networking/recipes-support/dnsmasq/dnsmasq_2.90.bb
+++ b/meta-networking/recipes-support/dnsmasq/dnsmasq_2.90.bb
@@ -22,6 +22,7 @@  SRC_URI = "http://www.thekelleys.org.uk/dnsmasq/${@['archive/', ''][float(d.getV
            file://CVE-2026-5172.patch \
            file://CVE-2026-2291.patch \
            file://CVE-2026-12725.patch \
+           file://CVE-2026-12969.patch \
 "
 SRC_URI[sha256sum] = "8f6666b542403b5ee7ccce66ea73a4a51cf19dd49392aaccd37231a2c51b303b"
 
diff --git a/meta-networking/recipes-support/dnsmasq/files/CVE-2026-12969.patch b/meta-networking/recipes-support/dnsmasq/files/CVE-2026-12969.patch
new file mode 100644
index 0000000000..e1fb9b225c
--- /dev/null
+++ b/meta-networking/recipes-support/dnsmasq/files/CVE-2026-12969.patch
@@ -0,0 +1,54 @@ 
+From bfac6db25b92b65d9d2f013534e7ebc265fec267 Mon Sep 17 00:00:00 2001
+From: do litli <dolitli02@gmail.com>
+Date: Sat, 9 May 2026 22:21:18 +0100
+Subject: [PATCH] Fix buffer OOB read in find_soa()
+
+In find_soa() extract_name() is called with extrabytes=0 when parsing NS
+record names, which means it only validates that the DNS name fits
+within the packet but does not check that 10 additional bytes exist for
+the type/class/TTL/rdlen fixed fields. Lines 546-549 then
+unconditionally read these 10 bytes via GETSHORT/GETLONG macros. An
+attacker controlling a DNS zone can craft a NXDOMAIN response where the
+NS record name extends to the packet boundary, causing a 10-byte
+out-of-bounds read past the valid packet data (CWE-125, CVSS 5.3
+Medium). The read stays within the over-allocated packet buffer in
+default configurations, limiting crash risk, but accesses data outside
+the logical packet boundary. Under certain conditions, the overread may
+access stale heap data from prior transactions.
+
+The fix is straightforward: change the extrabytes
+argument from 0 to 10, consistent with other call sites in
+the same file.
+
+Credit is due to do litli for finding this problem.
+
+CVE: CVE-2026-12969
+Upstream-Status: Backport [https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=14094e88beca519c53151184cc4553656672b54f]
+
+Backport Changes:
+- dnsmasq 2.90 predates the EXTR_NAME_EXTRACT constant and uses the
+  boolean isExtract argument. Retain 1 for this argument and backport
+  only the security-relevant extrabytes change from 0 to 10.
+
+(cherry picked from commit 14094e88beca519c53151184cc4553656672b54f)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ src/rfc1035.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/rfc1035.c b/src/rfc1035.c
+index 32dc571..8b00eb2 100644
+--- a/src/rfc1035.c
++++ b/src/rfc1035.c
+@@ -480,7 +480,7 @@ static int find_soa(struct dns_header *header, size_t qlen, char *name, int *sub
+   
+   for (i = 0; i < ntohs(header->nscount); i++)
+     {
+-      if (!extract_name(header, qlen, &p, daemon->workspacename, 1, 0))
++      if (!extract_name(header, qlen, &p, daemon->workspacename, 1, 10))
+ 	return 0; /* bad packet */
+       
+       GETSHORT(qtype, p); 
+-- 
+2.44.4
+