mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 22:15:20 +00:00
Code Issues Releases Wiki Activity

Merge branch '3622-serve-stale-rrsig-fix-security-v9_18' into 'security-v9_18'

Browse Source 
[9.18] [CVE-2022-3736] Properly handle stale RRSIG lookups

See merge request isc-private/bind9!485
This commit is contained in:
Michał Kępień
2023-01-12 11:31:41 +00:00
parent 35c40a8053 645dd3fdf1
commit 72db6402f3
3 changed files with 20 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@@ -1,3 +1,6 @@
6066. [security] Handle RRSIG lookups when serve-stale is active.
(CVE-2022-3736) [GL #3622]
6064. [security] An UPDATE message flood could cause named to exhaust all 6064. [security] An UPDATE message flood could cause named to exhaust all
available memory. This flaw was addressed by adding a available memory. This flaw was addressed by adding a
new "update-quota" statement that controls the number of new "update-quota" statement that controls the number of

8
doc/notes/notes-current.rst
View File

@@ -24,6 +24,14 @@ Security Fixes
ISC would like to thank Rob Schulhof from Infoblox for bringing this ISC would like to thank Rob Schulhof from Infoblox for bringing this
vulnerability to our attention. :gl:`#3523` vulnerability to our attention. :gl:`#3523`
- :iscman:`named` could crash with an assertion failure when an RRSIG
query was received and :any:`stale-answer-client-timeout` was set to a
non-zero value. This has been fixed. (CVE-2022-3736)
ISC would like to thank Borja Marcos from Sarenet (with assistance by
Iratxe Niño from Fundación Sarenet) for bringing this vulnerability to
our attention. :gl:`#3622`
New Features New Features
~~~~~~~~~~~~ ~~~~~~~~~~~~

18
lib/ns/query.c
View File

@@ -5237,6 +5237,15 @@ qctx_init(ns_client_t *client, dns_fetchevent_t **eventp, dns_rdatatype_t qtype,
qctx->result = ISC_R_SUCCESS; qctx->result = ISC_R_SUCCESS;
qctx->findcoveringnsec = qctx->view->synthfromdnssec; qctx->findcoveringnsec = qctx->view->synthfromdnssec;
/*
* If it's an RRSIG or SIG query, we'll iterate the node.
*/
if (qctx->qtype == dns_rdatatype_rrsig ||
qctx->qtype == dns_rdatatype_sig)
{
qctx->type = dns_rdatatype_any;
}
CALL_HOOK_NORETURN(NS_QUERY_QCTX_INITIALIZED, qctx); CALL_HOOK_NORETURN(NS_QUERY_QCTX_INITIALIZED, qctx);
} }
@@ -5424,15 +5433,6 @@ query_setup(ns_client_t *client, dns_rdatatype_t qtype) {
CALL_HOOK(NS_QUERY_SETUP, &qctx); CALL_HOOK(NS_QUERY_SETUP, &qctx);
/*
* If it's a SIG query, we'll iterate the node.
*/
if (qctx.qtype == dns_rdatatype_rrsig ||
qctx.qtype == dns_rdatatype_sig)
{
qctx.type = dns_rdatatype_any;
}
/* /*
* Check SERVFAIL cache * Check SERVFAIL cache
*/ */