diff mbox series

[meta-networking,wrynose,2/11] unbound: patch CVE-2026-81642

Message ID 20260927003921.746786-2-ankur.tyagi85@gmail.com
State New
Headers show
Series [meta-networking,wrynose,1/11] unbound: patch CVE-2026-80225 | expand

Commit Message

Ankur Tyagi Sept. 27, 2026, 12:39 a.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-81642

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../unbound/unbound/CVE-2026-81642.patch      | 30 +++++++++++++++++++
 .../recipes-support/unbound/unbound_1.24.2.bb |  1 +
 2 files changed, 31 insertions(+)
 create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-81642.patch
diff mbox series

Patch

diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-81642.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-81642.patch
new file mode 100644
index 0000000000..9f77424a95
--- /dev/null
+++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-81642.patch
@@ -0,0 +1,30 @@ 
+From a774b2050a1543e87def9cba0e25dcdabffde526 Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 16 Sep 2026 09:18:49 +0200
+Subject: [PATCH] - Fix CVE-2026-81642, Heap buffer overflow and possible
+ Remote Code   Execution when digesting DNSKEY. Thanks to Yuqi Qiu and Xiang
+ Li   from Nankai University, AOSP Lab for the report.
+
+(cherry picked from commit 8c2e0fd6cc5b6eaa618ac72227808824b4edee7c)
+
+CVE: CVE-2026-81642
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/8c2e0fd6cc5b6eaa618ac72227808824b4edee7c]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ validator/val_sigcrypt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/validator/val_sigcrypt.c b/validator/val_sigcrypt.c
+index cde281870..b9bfe685c 100644
+--- a/validator/val_sigcrypt.c
++++ b/validator/val_sigcrypt.c
+@@ -305,6 +305,8 @@ ds_create_dnskey_digest(struct module_env* env,
+ 	 * digest = digest_algorithm( DNSKEY owner name | DNSKEY RDATA);
+ 	 *	DNSKEY RDATA = Flags | Protocol | Algorithm | Public Key. */
+ 	sldns_buffer_clear(b);
++	if(!sldns_buffer_available(b, dnskey_rrset->rk.dname_len + dnskey_len-2))
++		return 0; /* buffer too small */
+ 	sldns_buffer_write(b, dnskey_rrset->rk.dname, 
+ 		dnskey_rrset->rk.dname_len);
+ 	query_dname_tolower(sldns_buffer_begin(b));
diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
index 0b59d7c9f9..c8d7c6cdab 100644
--- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
+++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
@@ -44,6 +44,7 @@  SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
            file://CVE-2026-56416.patch \
            file://CVE-2026-56444.patch \
            file://CVE-2026-80225.patch \
+           file://CVE-2026-81642.patch \
            "
 
 SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"