mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 22:15:20 +00:00
Code Issues Releases Wiki Activity

Merge branch '4334-confidential-dns64-and-serve-stale' into 'v9.19.20-release'

Browse Source 
[CVE-2023-5679] Fix a bad interaction between DNS64 and serve-stale

See merge request isc-private/bind9!588
This commit is contained in:
Michał Kępień
2024-01-05 11:22:24 +00:00
parent 9fbafe83d2 c4faf5c69f
commit cddf3b267b
3 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@@ -2,7 +2,8 @@
6318. [placeholder] 6318. [placeholder]
6317. [placeholder] 6317. [security] Restore DNS64 state when handling a serve-stale timeout.
(CVE-2023-5679) [GL #4334]
6316. [security] Specific queries could trigger an assertion check with 6316. [security] Specific queries could trigger an assertion check with
nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281] nxdomain-redirect enabled. (CVE-2023-5517) [GL #4281]

5
doc/notes/notes-current.rst
View File

@@ -27,6 +27,11 @@ Security Fixes
assertion failure when :any:`nxdomain-redirect` was enabled. This has assertion failure when :any:`nxdomain-redirect` was enabled. This has
been fixed. :cve:`2023-5517` :gl:`#4281` been fixed. :cve:`2023-5517` :gl:`#4281`
- A bad interaction between DNS64 and serve-stale could cause
:iscman:`named` to crash with an assertion failure, when both of these
features were enabled. This has been fixed. :cve:`2023-5679`
:gl:`#4334`
New Features New Features
~~~~~~~~~~~~ ~~~~~~~~~~~~

7
lib/ns/query.c
View File

@@ -6251,6 +6251,13 @@ query_lookup_stale(ns_client_t *client) {
query_ctx_t qctx; query_ctx_t qctx;
qctx_init(client, NULL, client->query.qtype, &qctx); qctx_init(client, NULL, client->query.qtype, &qctx);
if (DNS64(client)) {
qctx.qtype = qctx.type = dns_rdatatype_a;
qctx.dns64 = true;
}
if (DNS64EXCLUDE(client)) {
qctx.dns64_exclude = true;
}
dns_db_attach(client->view->cachedb, &qctx.db); dns_db_attach(client->view->cachedb, &qctx.db);
client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK; client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK;
client->query.dboptions |= DNS_DBFIND_STALETIMEOUT; client->query.dboptions |= DNS_DBFIND_STALETIMEOUT;