[meta-networking,wrynose,2/32] unbound: patch CVE-2026-33278

Message ID	20260910230932.173913-2-ankur.tyagi85@gmail.com
State	Under Review
Delegated to:	Anuj Mittal
Headers	show Return-Path: <ankur.tyagi85@gmail.com> ip: 74.125.227.140, mailfrom: ankur.tyagi85@gmail.com) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi <ankur.tyagi85@gmail.com> Subject: [oe][meta-networking][wrynose][PATCH 2/32] unbound: patch CVE-2026-33278 Date: Fri, 11 Sep 2026 11:09:01 +1200 Message-ID: <20260910230932.173913-2-ankur.tyagi85@gmail.com> In-Reply-To: <20260910230932.173913-1-ankur.tyagi85@gmail.com> References: <20260910230932.173913-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[meta-oe,wrynose,1/32] zabbix: ignore multiple CVEs \| expand [meta-oe,wrynose,1/32] zabbix: ignore multiple CVEs [meta-networking,wrynose,2/32] unbound: patch CVE-2026-33278 [meta-networking,wrynose,3/32] unbound: patch CVE-2026-42944 [meta-networking,wrynose,4/32] unbound: patch CVE-2026-42959 [meta-networking,wrynose,5/32] unbound: patch CVE-2026-32792 [meta-networking,wrynose,6/32] unbound: patch CVE-2026-40622 [meta-networking,wrynose,7/32] unbound: patch CVE-2026-41292 [meta-networking,wrynose,8/32] unbound: patch CVE-2026-42534 [meta-networking,wrynose,9/32] unbound: patch CVE-2026-42923 [meta-networking,wrynose,10/32] unbound: patch CVE-2026-42960 [meta-networking,wrynose,11/32] unbound: patch CVE-2026-44390 [meta-networking,wrynose,12/32] unbound: patch CVE-2026-44608 [meta-networking,wrynose,13/32] unbound: patch CVE-2026-46582 [meta-networking,wrynose,14/32] unbound: patch CVE-2026-32665 [meta-networking,wrynose,15/32] unbound: patch CVE-2026-42955 [meta-networking,wrynose,16/32] unbound: patch CVE-2026-44621 [meta-networking,wrynose,17/32] unbound: patch CVE-2026-44687 [meta-networking,wrynose,18/32] unbound: patch CVE-2026-50045 [meta-networking,wrynose,19/32] unbound: patch CVE-2026-50046 [meta-networking,wrynose,20/32] unbound: patch CVE-2026-50243 [meta-networking,wrynose,21/32] unbound: patch CVE-2026-50248 [meta-networking,wrynose,22/32] unbound: patch CVE-2026-50251 [meta-networking,wrynose,23/32] unbound: patch CVE-2026-50252 [meta-networking,wrynose,24/32] unbound: patch CVE-2026-52863 [meta-networking,wrynose,25/32] unbound: patch CVE-2026-54478 [meta-networking,wrynose,26/32] unbound: patch CVE-2026-55708 [meta-networking,wrynose,27/32] unbound: patch CVE-2026-55717 [meta-networking,wrynose,28/32] unbound: patch CVE-2026-55973 [meta-networking,wrynose,29/32] unbound: patch CVE-2026-55990 [meta-networking,wrynose,30/32] unbound: patch CVE-2026-55991 [meta-networking,wrynose,31/32] unbound: patch CVE-2026-56416 [meta-networking,wrynose,32/32] unbound: patch CVE-2026-56444

diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-33278.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-33278.patch new file mode 100644 index 0000000000..b42b613546 --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-33278.patch @@ -0,0 +1,296 @@ +From f7633e132f79548d71c02ed66d55a82c23ea0a82 Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl> +Date: Wed, 20 May 2026 10:13:08 +0200 +Subject: [PATCH] - Fix CVE-2026-33278, Possible remote code execution during + DNSSEC validation. Thanks to Qifan Zhang, Palo Alto Networks, for the + report. + +(cherry picked from commit 6a31e470f80a6e5c559ebe7fd4cfc0582d3b6d0a) + +CVE: CVE-2026-33278 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/6a31e470f80a6e5c559ebe7fd4cfc0582d3b6d0a] + +Dropped changes to the Changelog file. + +Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> +--- + services/cache/dns.c | 8 +++- + testdata/val_nsec3_iter_high.rpl | 18 ++++---- + testdata/val_nx_nsec3_collision.rpl | 31 +++++-------- + testdata/val_nx_nsec3_params.rpl | 22 +++++---- + validator/val_nsec3.c | 71 +++++++++++++++++++++++++++++ + 5 files changed, 111 insertions(+), 39 deletions(-) + +diff --git a/services/cache/dns.c b/services/cache/dns.c +index 351b3568c..8dae2ffcc 100644 +--- a/services/cache/dns.c ++++ b/services/cache/dns.c +@@ -675,10 +675,16 @@ struct dns_msg* + dns_msg_deepcopy_region(struct dns_msg* origin, struct regional* region) + { + size_t i; ++ struct ub_packed_rrset_key** saved_rrsets; + struct dns_msg* res = NULL; ++ size_t rep_alloc_size = sizeof(struct reply_info) ++ - sizeof(struct rrset_ref); /* this is the size of res->rep ++ allocated in gen_dns_msg() */ + res = gen_dns_msg(region, &origin->qinfo, origin->rep->rrset_count); + if(!res) return NULL; +- *res->rep = *origin->rep; ++ saved_rrsets = res->rep->rrsets; /* save rrsets alloc by gen_dns_msg */ ++ memcpy(res->rep, origin->rep, rep_alloc_size); ++ res->rep->rrsets = saved_rrsets; + if(origin->rep->reason_bogus_str) { + res->rep->reason_bogus_str = regional_strdup(region, + origin->rep->reason_bogus_str); +diff --git a/testdata/val_nsec3_iter_high.rpl b/testdata/val_nsec3_iter_high.rpl +index 2b78f0b7f..703092d89 100644 +--- a/testdata/val_nsec3_iter_high.rpl ++++ b/testdata/val_nsec3_iter_high.rpl +@@ -120,12 +120,12 @@ example.com. IN SOA ns.example.com. hostmaster.example.com. 2007090400 28800 720 + example.com. 3600 IN RRSIG SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFCNGZ+/OfElYQMCZ77O9Lw9rhk7PAhUAmDcvTAst6Bq83qPq3r6c/Dm1nFc= ;{id = 2854} + + ; closest encloser, H(example.com). +-6md8numosa4q9ugkffdo1bmm82t5j39s.example.com. NSEC3 1 1 8 - 6md8numosa4q9ugkffdo1bmm82t5j49s SOA NS MX DNSKEY RRSIG +-6md8numosa4q9ugkffdo1bmm82t5j39s.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCz/LkFOFcaQzVnyySW9ZoVUnxh7gIUdxyS9vqVDzo8pGhFU+3YogN2ZRk= ;{id = 2854} ++b6fuorg741ufili49mg9j4328ig53sqg.example.com. NSEC3 1 1 123 aabb00123456bbccdd b6fuorg741ufili49mg9j4328ig53sqh SOA NS MX DNSKEY RRSIG ++b6fuorg741ufili49mg9j4328ig53sqg.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. AJlV5car66lq5f0ASx7W47A/OADkARAXzKt9ZLojXze+FWK9JjAX+eA= + +-; wildcard denial, H(*.example.com.) = 4f3cnt8cu22tngec382jj4gde4rb47ub +-4f3cnt8cu22tngec382jj4gde4rb46ub.example.com. NSEC3 1 1 0 - 4f3cnt8cu22tngec382jj4gde4rb48ub A MX RRSIG +-4f3cnt8cu22tngec382jj4gde4rb46ub.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MCwCFHS+i/OB/V/gYmS1eQTXieXIXGjsAhQQ0Ql7TW/hsUklrb0DfoyhVPG95Q== ;{id = 2854} ++; wildcard denial, H(*.example.com.) = k1a2vr9c269jummpru5d68qllbfmtdcb. ++k1a2vr9c269jummpru5d68qllbfmtacb.example.com. NSEC3 1 1 123 aabb00123456bbccdd k1a2vr9c269jummpru5d68qllbfmtgcb A MX RRSIG ++k1a2vr9c269jummpru5d68qllbfmtacb.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. AARB9z4C1WZUI3WP3QAR7RJXFnN0qEBkEt8ocudxXzms4/7/2l6NNWc= + + ; next closer name, H(www.example.com.) = s1unhcti19bkdr98fegs0v46mbu3t4m3. + s1unhcti19bkdr98fegs0v46mbu3t4m2.example.com. NSEC3 1 1 123 aabb00123456bbccdd s1unhcti19bkdr98fegs0v46mbu3t4m4 A MX RRSIG +@@ -152,10 +152,10 @@ SECTION ANSWER + SECTION AUTHORITY + example.com. IN SOA ns.example.com. hostmaster.example.com. 2007090400 28800 7200 604800 18000 + example.com. 3600 IN RRSIG SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFCNGZ+/OfElYQMCZ77O9Lw9rhk7PAhUAmDcvTAst6Bq83qPq3r6c/Dm1nFc= ;{id = 2854} +-6md8numosa4q9ugkffdo1bmm82t5j39s.example.com. NSEC3 1 1 8 - 6md8numosa4q9ugkffdo1bmm82t5j49s SOA NS MX DNSKEY RRSIG +-6md8numosa4q9ugkffdo1bmm82t5j39s.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCz/LkFOFcaQzVnyySW9ZoVUnxh7gIUdxyS9vqVDzo8pGhFU+3YogN2ZRk= ;{id = 2854} +-4f3cnt8cu22tngec382jj4gde4rb46ub.example.com. NSEC3 1 1 0 - 4f3cnt8cu22tngec382jj4gde4rb48ub A MX RRSIG +-4f3cnt8cu22tngec382jj4gde4rb46ub.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MCwCFHS+i/OB/V/gYmS1eQTXieXIXGjsAhQQ0Ql7TW/hsUklrb0DfoyhVPG95Q== ;{id = 2854} ++b6fuorg741ufili49mg9j4328ig53sqg.example.com. NSEC3 1 1 123 aabb00123456bbccdd b6fuorg741ufili49mg9j4328ig53sqh SOA NS MX DNSKEY RRSIG ++b6fuorg741ufili49mg9j4328ig53sqg.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. AJlV5car66lq5f0ASx7W47A/OADkARAXzKt9ZLojXze+FWK9JjAX+eA= ++k1a2vr9c269jummpru5d68qllbfmtacb.example.com. NSEC3 1 1 123 aabb00123456bbccdd k1a2vr9c269jummpru5d68qllbfmtgcb A MX RRSIG ++k1a2vr9c269jummpru5d68qllbfmtacb.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. AARB9z4C1WZUI3WP3QAR7RJXFnN0qEBkEt8ocudxXzms4/7/2l6NNWc= + s1unhcti19bkdr98fegs0v46mbu3t4m2.example.com. NSEC3 1 1 123 aabb00123456bbccdd s1unhcti19bkdr98fegs0v46mbu3t4m4 A MX RRSIG + s1unhcti19bkdr98fegs0v46mbu3t4m2.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFFSH4klZKke48dYyddYDj17gjTS0AhUAltWicpFLWqW98/Af9Qlx70MH8o4= ;{id = 2854} + +diff --git a/testdata/val_nx_nsec3_collision.rpl b/testdata/val_nx_nsec3_collision.rpl +index 87a55f565..1b1f49e80 100644 +--- a/testdata/val_nx_nsec3_collision.rpl ++++ b/testdata/val_nx_nsec3_collision.rpl +@@ -89,6 +89,17 @@ ns.example.com. IN A 1.2.3.4 + ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} + ENTRY_END + ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++ns.example.com. IN AAAA ++SECTION AUTHORITY ++example.com. IN SOA ns.example.com. hostmaster.example.com. 2007090400 28800 7200 604800 18000 ++example.com. 3600 IN RRSIG SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFCNGZ+/OfElYQMCZ77O9Lw9rhk7PAhUAmDcvTAst6Bq83qPq3r6c/Dm1nFc= ;{id = 2854} ++ENTRY_END ++ + ; response to DNSKEY priming query + ENTRY_BEGIN + MATCH opcode qtype qname +@@ -163,29 +174,11 @@ STEP 2 TIME_PASSES ELAPSE 0.05 + STEP 10 CHECK_ANSWER + ENTRY_BEGIN + MATCH all +-REPLY QR RD RA DO NXDOMAIN ++REPLY QR RD RA DO SERVFAIL + SECTION QUESTION + www.example.com. IN A + SECTION ANSWER + SECTION AUTHORITY +-example.com. IN SOA ns.example.com. hostmaster.example.com. 2007090400 28800 7200 604800 18000 +-example.com. 3600 IN RRSIG SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFCNGZ+/OfElYQMCZ77O9Lw9rhk7PAhUAmDcvTAst6Bq83qPq3r6c/Dm1nFc= ;{id = 2854} +-6md8numosa4q9ugkffdo1bmm82t5j39s.example.com. NSEC3 1 1 123 aabb00123456bbccdd 6md8numosa4q9ugkffdo1bmm82t5j49s A RRSIG +-6md8numosa4q9ugkffdo1bmm82t5j39s.example.com. NSEC3 1 1 8 - 6md8numosa4q9ugkffdo1bmm82t5j49s SOA NS MX DNSKEY RRSIG +-6md8numosa4q9ugkffdo1bmm82t5j39s.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MCwCFHndWrEEbuzezs/4lxeiMgEuUsUbAhR72gJgd/Zmhf80yoxCauw9k5OkCw== ;{id = 2854} +-4f3cnt8cu22tngec382jj4gde4rb46ub.example.com. NSEC3 1 1 18 - 4f3cnt8cu22tngec382jj4gde4rb87ub A RRSIG +-4f3cnt8cu22tngec382jj4gde4rb46ub.example.com. NSEC3 1 1 0 - 4f3cnt8cu22tngec382jj4gde4rb48ub A MX RRSIG +-4f3cnt8cu22tngec382jj4gde4rb46ub.example.com. NSEC3 1 1 19 - 4f3cnt8cu22tngec382jj4gde4rb87ub A RRSIG +-4f3cnt8cu22tngec382jj4gde4rb46ub.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MCwCFDRwji51WCXJg7W/3+Jx586af5qgAhQPxHegtzu1I/QbvCNrOOON05N1rw== ;{id = 2854} +-s1unhcti19bkdr98fegs0v46mbu3t4m2.example.com. NSEC3 1 1 18 - s1unhcti19bkdr98fegs0v46mbu3t4m4 A RRSIG +-s1unhcti19bkdr98fegs0v46mbu3t4m2.example.com. NSEC3 1 1 19 - s1unhcti19bkdr98fegs0v46mbu3t4m4 A RRSIG +-s1unhcti19bkdr98fegs0v46mbu3t4m2.example.com. NSEC3 1 1 20 00 s1unhcti19bkdr98fegs0v46mbu3t4m4 A RRSIG +-s1unhcti19bkdr98fegs0v46mbu3t4m2.example.com. NSEC3 1 1 123 aabb00123456bbccdd s1unhcti19bkdr98fegs0v46mbu3t4m4 A MX RRSIG +-s1unhcti19bkdr98fegs0v46mbu3t4m2.example.com. NSEC3 1 1 20 01 s1unhcti19bkdr98fegs0v46mbu3t4m4 A RRSIG +-s1unhcti19bkdr98fegs0v46mbu3t4m2.example.com. NSEC3 1 1 20 02 s1unhcti19bkdr98fegs0v46mbu3t4m4 A RRSIG +-s1unhcti19bkdr98fegs0v46mbu3t4m2.example.com. NSEC3 1 1 20 03 s1unhcti19bkdr98fegs0v46mbu3t4m4 A RRSIG +-s1unhcti19bkdr98fegs0v46mbu3t4m2.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MCwCFDLy4GbR8ZaKHATVJGnGxzpsuq60AhQ1/pRbXi1ZbcYohzHgWzNC50fC5A== ;{id = 2854} +- + SECTION ADDITIONAL + ENTRY_END + +diff --git a/testdata/val_nx_nsec3_params.rpl b/testdata/val_nx_nsec3_params.rpl +index dd3ab6b57..59bef2be3 100644 +--- a/testdata/val_nx_nsec3_params.rpl ++++ b/testdata/val_nx_nsec3_params.rpl +@@ -88,6 +88,17 @@ ns.example.com. IN A 1.2.3.4 + ns.example.com. 3600 IN RRSIG A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854} + ENTRY_END + ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++ns.example.com. IN AAAA ++SECTION AUTHORITY ++example.com. IN SOA ns.example.com. hostmaster.example.com. 2007090400 28800 7200 604800 18000 ++example.com. 3600 IN RRSIG SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFCNGZ+/OfElYQMCZ77O9Lw9rhk7PAhUAmDcvTAst6Bq83qPq3r6c/Dm1nFc= ;{id = 2854} ++ENTRY_END ++ + ; response to DNSKEY priming query + ENTRY_BEGIN + MATCH opcode qtype qname +@@ -144,20 +155,11 @@ ENTRY_END + STEP 10 CHECK_ANSWER + ENTRY_BEGIN + MATCH all +-REPLY QR RD RA DO NXDOMAIN ++REPLY QR RD RA DO SERVFAIL + SECTION QUESTION + www.example.com. IN A + SECTION ANSWER + SECTION AUTHORITY +-example.com. IN SOA ns.example.com. hostmaster.example.com. 2007090400 28800 7200 604800 18000 +-example.com. 3600 IN RRSIG SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFCNGZ+/OfElYQMCZ77O9Lw9rhk7PAhUAmDcvTAst6Bq83qPq3r6c/Dm1nFc= ;{id = 2854} +-6md8numosa4q9ugkffdo1bmm82t5j39s.example.com. NSEC3 1 1 8 - 6md8numosa4q9ugkffdo1bmm82t5j49s SOA NS MX DNSKEY RRSIG +-6md8numosa4q9ugkffdo1bmm82t5j39s.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCz/LkFOFcaQzVnyySW9ZoVUnxh7gIUdxyS9vqVDzo8pGhFU+3YogN2ZRk= ;{id = 2854} +-4f3cnt8cu22tngec382jj4gde4rb46ub.example.com. NSEC3 1 1 0 - 4f3cnt8cu22tngec382jj4gde4rb48ub A MX RRSIG +-4f3cnt8cu22tngec382jj4gde4rb46ub.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MCwCFHS+i/OB/V/gYmS1eQTXieXIXGjsAhQQ0Ql7TW/hsUklrb0DfoyhVPG95Q== ;{id = 2854} +-s1unhcti19bkdr98fegs0v46mbu3t4m2.example.com. NSEC3 1 1 123 aabb00123456bbccdd s1unhcti19bkdr98fegs0v46mbu3t4m4 A MX RRSIG +-s1unhcti19bkdr98fegs0v46mbu3t4m2.example.com. 3600 IN RRSIG NSEC3 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFFSH4klZKke48dYyddYDj17gjTS0AhUAltWicpFLWqW98/Af9Qlx70MH8o4= ;{id = 2854} +- + SECTION ADDITIONAL + ENTRY_END + +diff --git a/validator/val_nsec3.c b/validator/val_nsec3.c +index 998fcc4e3..92d853825 100644 +--- a/validator/val_nsec3.c ++++ b/validator/val_nsec3.c +@@ -456,6 +456,67 @@ filter_init(struct nsec3_filter* filter, struct ub_packed_rrset_key** list, + } + } + ++/** Check if the NSEC3s have the same parameter set. */ ++static int ++param_set_same(struct nsec3_filter* flt, char** reason) ++{ ++ size_t rrsetnum; ++ int rrnum; ++ struct ub_packed_rrset_key* rrset; ++ int have_params = 0; ++ int first_algo = 0; ++ size_t first_iter = 0; ++ uint8_t* first_salt = NULL; ++ size_t first_saltlen = 0; ++ ++ /* If the NSEC3 parameter sets have distinct values, then they are ++ * from different NSEC3 chains, and we do not want that. */ ++ for(rrset=filter_first(flt, &rrsetnum, &rrnum); rrset; ++ rrset=filter_next(flt, &rrsetnum, &rrnum)) { ++ if(!have_params) { ++ first_algo = nsec3_get_algo(rrset, rrnum); ++ first_iter = nsec3_get_iter(rrset, rrnum); ++ if(!nsec3_get_salt(rrset, rrnum, &first_salt, ++ &first_saltlen)) { ++ verbose(VERB_ALGO, "NSEC3 salt malformed"); ++ if(reason) ++ *reason = "NSEC3 salt malformed"; ++ return 0; ++ } ++ have_params = 1; ++ } else { ++ uint8_t* salt = NULL; ++ size_t saltlen = 0; ++ if(nsec3_get_algo(rrset, rrnum) != first_algo) { ++ verbose(VERB_ALGO, "NSEC3 algorithm mismatch"); ++ if(reason) ++ *reason = "NSEC3 algorithm mismatch"; ++ return 0; ++ } ++ if(nsec3_get_iter(rrset, rrnum) != first_iter) { ++ verbose(VERB_ALGO, "NSEC3 iterations mismatch"); ++ if(reason) ++ *reason = "NSEC3 iterations mismatch"; ++ return 0; ++ } ++ if(!nsec3_get_salt(rrset, rrnum, &salt, &saltlen)) { ++ verbose(VERB_ALGO, "NSEC3 salt malformed"); ++ if(reason) ++ *reason = "NSEC3 salt malformed"; ++ return 0; ++ } ++ if(saltlen != first_saltlen || ++ memcmp(salt, first_salt, saltlen) != 0) { ++ verbose(VERB_ALGO, "NSEC3 salt mismatch"); ++ if(reason) ++ *reason = "NSEC3 salt mismatch"; ++ return 0; ++ } ++ } ++ } ++ return 1; ++} ++ + /** + * Find max iteration count using config settings and key size + * @param ve: validator environment with iteration count config settings. +@@ -1192,6 +1253,8 @@ nsec3_prove_nameerror(struct module_env* env, struct val_env* ve, + filter_init(&flt, list, num, qinfo); /* init RR iterator */ + if(!flt.zone) + return sec_status_bogus; /* no RRs */ ++ if(!param_set_same(&flt, NULL)) ++ return sec_status_bogus; /* nsec3 params from distinct chains*/ + if(nsec3_iteration_count_high(ve, &flt, kkey)) + return sec_status_insecure; /* iteration count too high */ + log_nametypeclass(VERB_ALGO, "start nsec3 nameerror proof, zone", +@@ -1378,6 +1441,8 @@ nsec3_prove_nodata(struct module_env* env, struct val_env* ve, + filter_init(&flt, list, num, qinfo); /* init RR iterator */ + if(!flt.zone) + return sec_status_bogus; /* no RRs */ ++ if(!param_set_same(&flt, NULL)) ++ return sec_status_bogus; /* nsec3 params from distinct chains*/ + if(nsec3_iteration_count_high(ve, &flt, kkey)) + return sec_status_insecure; /* iteration count too high */ + return nsec3_do_prove_nodata(env, &flt, ct, qinfo, calc); +@@ -1401,6 +1466,8 @@ nsec3_prove_wildcard(struct module_env* env, struct val_env* ve, + filter_init(&flt, list, num, qinfo); /* init RR iterator */ + if(!flt.zone) + return sec_status_bogus; /* no RRs */ ++ if(!param_set_same(&flt, NULL)) ++ return sec_status_bogus; /* nsec3 params from distinct chains*/ + if(nsec3_iteration_count_high(ve, &flt, kkey)) + return sec_status_insecure; /* iteration count too high */ + +@@ -1503,6 +1570,8 @@ nsec3_prove_nods(struct module_env* env, struct val_env* ve, + *reason = "no NSEC3 records"; + return sec_status_bogus; /* no RRs */ + } ++ if(!param_set_same(&flt, reason)) ++ return sec_status_bogus; /* nsec3 params from distinct chains*/ + if(nsec3_iteration_count_high(ve, &flt, kkey)) + return sec_status_insecure; /* iteration count too high */ + +@@ -1596,6 +1665,8 @@ nsec3_prove_nxornodata(struct module_env* env, struct val_env* ve, + filter_init(&flt, list, num, qinfo); /* init RR iterator */ + if(!flt.zone) + return sec_status_bogus; /* no RRs */ ++ if(!param_set_same(&flt, NULL)) ++ return sec_status_bogus; /* nsec3 params from distinct chains*/ + if(nsec3_iteration_count_high(ve, &flt, kkey)) + return sec_status_insecure; /* iteration count too high */ + diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb index e41e2dc065..d703b27506 100644 --- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb +++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb @@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=5308494bc0590c0cb036afd781d78f06" SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;tag=release-${PV} \ file://run-ptest \ + file://CVE-2026-33278.patch \ " SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"

[meta-networking,wrynose,2/32] unbound: patch CVE-2026-33278

Commit Message

Patch