Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], [email protected] Control: affects -1 + src:dnsmasq User: [email protected] Usertags: pu
[ Reason ] This fixes CVE-2026-12725 and CVE-2026-12969 for trixie. These flaws have been discovered and fixed upstream in pre-releases of dnsmasq/2.93, currently in unstable in testing. [ Impact ] CVE-2026-12725: A remote attacker able to supply a crafted DNS response may crash the dnsmasq process, resulting in denial of service. CVE-2026-12969: A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of- bounds read, potentially accessing stale data from prior transactions. [ Tests ] In Debian, no tests specific to the affected code have been executed. However, the changes are cherry-picked from dnsmasq/2.93 which is already publicly in use. There have been no reports about regressions. Autopkgtest run successfully locally and on Debusine: https://debusine.debian.net/debian/developers/work-request/1211374/ [ Risks ] I consider the risks low as dnsmasq/2.93 is already publicly in use. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in stable [x] the issue is verified as fixed in unstable Sven -- GPG Fingerprint 3DF5 E8AA 43FC 9FDF D086 F195 ADF5 0EDA F8AD D585
diff -Nru dnsmasq-2.91/debian/changelog dnsmasq-2.91/debian/changelog --- dnsmasq-2.91/debian/changelog 2026-05-02 18:50:46.000000000 +0200 +++ dnsmasq-2.91/debian/changelog 2026-09-01 15:47:50.000000000 +0200 @@ -1,3 +1,11 @@ +dnsmasq (2.91-1+deb13u2) trixie; urgency=medium + + * d/p/*: + - CVE-2026-12725.patch: Fix heap-based buffer overflow. + - CVE-2026-12969.patch: Fix out-of-bounds read vulnerability. + + -- Sven Geuer <[email protected]> Tue, 01 Sep 2026 15:47:50 +0200 + dnsmasq (2.91-1+deb13u1) trixie-security; urgency=high * d/p/*: diff -Nru dnsmasq-2.91/debian/patches/CVE-2026-12725.patch dnsmasq-2.91/debian/patches/CVE-2026-12725.patch --- dnsmasq-2.91/debian/patches/CVE-2026-12725.patch 1970-01-01 01:00:00.000000000 +0100 +++ dnsmasq-2.91/debian/patches/CVE-2026-12725.patch 2026-09-01 15:47:50.000000000 +0200 @@ -0,0 +1,84 @@ +commit 36d081e37477027fd721fea498f3760f529034ad +Author: Simon Kelley <[email protected]> +Date: Tue Apr 21 22:14:41 2026 +0100 + + Fix buffer overlow in log_query() + + The addition of "(not supported)" to logs of DS and DNSKEY replies + overflows the buffer used to construct the string. + + Re-arrange things to avoid this, and add checks to avoid the same problem + if the logging calls change in the future. + + Thanks to Yiwei Hou for finding this. + + The problem exists is DNSSEC is enabled and query logging is also + enabled. The overwrite is of bounded length and the bytes + written are not in control of an attacker, so this is not considered + a likely remote-execution vector. + +--- a/src/cache.c ++++ b/src/cache.c +@@ -2174,7 +2174,7 @@ + return; + + /* build query type string if requested */ +- if (!(flags & (F_SERVER | F_IPSET)) && type > 0) ++ if (!(flags & (F_SERVER | F_IPSET | F_KEYTAG | F_RR)) && type > 0) + arg = querystr(arg, type); + + dest = arg; +@@ -2190,15 +2190,21 @@ + { + dest = daemon->addrbuff; + +- if (flags & F_RR) +- { +- if (flags & F_KEYTAG) +- dest = querystr(NULL, addr->rrblock.rrtype); +- else +- dest = querystr(NULL, addr->rrdata.rrtype); +- } +- else if (flags & F_KEYTAG) +- sprintf(daemon->addrbuff, arg, addr->log.keytag, addr->log.algo, addr->log.digest); ++ if (flags & F_RR) ++ { ++ if (flags & F_KEYTAG) ++ dest = querystr(NULL, addr->rrblock.rrtype); ++ else ++ dest = querystr(NULL, addr->rrdata.rrtype); ++ } ++#ifdef HAVE_DNSSEC ++ else if (flags & F_KEYTAG) ++ { ++ snprintf(daemon->addrbuff, ADDRSTRLEN, arg, addr->log.keytag, addr->log.algo, addr->log.digest); ++ if (type) ++ extra = " (not supported)"; ++ } ++#endif + else if (flags & F_RCODE) + { + unsigned int rcode = addr->log.rcode; +--- a/src/dnssec.c ++++ b/src/dnssec.c +@@ -955,10 +955,7 @@ + + a.log.keytag = keytag; + a.log.algo = algo; +- if (algo_digest_name(algo)) +- log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DNSKEY keytag %hu, algo %hu", 0); +- else +- log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DNSKEY keytag %hu, algo %hu (not supported)", 0); ++ log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DNSKEY keytag %hu, algo %hu", !algo_digest_name(algo)); + } + } + +@@ -1084,7 +1081,7 @@ + a.log.keytag = keytag; + a.log.algo = algo; + a.log.digest = digest; +- log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DS for keytag %hu, algo %hu, digest %hu (not supported)", 0); ++ log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DS for keytag %hu, algo %hu, digest %hu", 1); + neg_ttl = ttl; + } + else if ((key = blockdata_alloc((char*)p, rdlen - 4))) diff -Nru dnsmasq-2.91/debian/patches/CVE-2026-12969.patch dnsmasq-2.91/debian/patches/CVE-2026-12969.patch --- dnsmasq-2.91/debian/patches/CVE-2026-12969.patch 1970-01-01 01:00:00.000000000 +0100 +++ dnsmasq-2.91/debian/patches/CVE-2026-12969.patch 2026-09-01 15:47:50.000000000 +0200 @@ -0,0 +1,36 @@ +commit 14094e88beca519c53151184cc4553656672b54f +Author: do litli <[email protected]> +Date: Sat May 9 22:21:18 2026 +0100 + + Fix buffer OOB read in find_soa() + + In find_soa() extract_name() is called with extrabytes=0 when parsing NS + record names, which means it only validates that the DNS name fits + within the packet but does not check that 10 additional bytes exist for + the type/class/TTL/rdlen fixed fields. Lines 546-549 then + unconditionally read these 10 bytes via GETSHORT/GETLONG macros. An + attacker controlling a DNS zone can craft a NXDOMAIN response where the + NS record name extends to the packet boundary, causing a 10-byte + out-of-bounds read past the valid packet data (CWE-125, CVSS 5.3 + Medium). The read stays within the over-allocated packet buffer in + default configurations, limiting crash risk, but accesses data outside + the logical packet boundary. Under certain conditions, the overread may + access stale heap data from prior transactions. + + The fix is straightforward: change the extrabytes + argument from 0 to 10, consistent with other call sites in + the same file. + + Credit is due to do litli for finding this problem. + +--- a/src/rfc1035.c ++++ b/src/rfc1035.c +@@ -533,7 +533,7 @@ + + for (i = 0; i < ntohs(header->nscount); i++) + { +- if (!extract_name(header, qlen, &p, daemon->workspacename, EXTR_NAME_EXTRACT, 0)) ++ if (!extract_name(header, qlen, &p, daemon->workspacename, EXTR_NAME_EXTRACT, 10)) + return 0; /* bad packet */ + + GETSHORT(qtype, p); diff -Nru dnsmasq-2.91/debian/patches/series dnsmasq-2.91/debian/patches/series --- dnsmasq-2.91/debian/patches/series 2026-05-02 18:50:46.000000000 +0200 +++ dnsmasq-2.91/debian/patches/series 2026-09-01 15:47:50.000000000 +0200 @@ -6,3 +6,5 @@ CVE-2026-4892.patch CVE-2026-4893.patch CVE-2026-5172.patch +CVE-2026-12725.patch +CVE-2026-12969.patch
signature.asc
Description: This is a digitally signed message part
