fix(cve): CVE-2026-76163 - Always create the TKEY context - #14
Merged
Merged
Conversation
CVE: CVE-2026-76163 (high) - If BIND is loaded with a named.conf file that contains no global options block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit. Upstream: isc-projects/bind9@4a48f9b73f Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
Contributor
Author
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
TAG Bot TAG: 1%9.20.23-1_deb13u1deepin12 |
Contributor
Author
|
/hold |
…g SIG(0) CVE: CVE-2026-77692 (high) - 修复使用 SIG(0) 的 HTTPS 未认证崩溃漏洞 Upstream: https://github.com/isc-projects/bind9/commit/d1c25323509173e4d65785e1d1781de77bf461a6.patch Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
… DNS64 filter64 path CVE: CVE-2026-19666 (high) - On a resolver configured to use dns64, if an applicable answer from the authoritative server is malformed in a specific way, the resolver named process will exit unexpectedly. Upstream: isc-projects/bind9@9ddfd2e4da7374ab2f6eaa67cd48d99116a8f60e,https://github.com/isc-projects/bind9/commit/bc4a9ce4d3940f1c5f02f885253e7fbe201de7c4 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…data lookups fail CVE: CVE-2026-81563 (high) - A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups. Upstream: CVEProject/cvelistV5@3da381e Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
CVE: CVE-2026-81563 - 兼容性适配修改：将不存在的 dns_rdataset_cleanup 替换为已有的 dns_rdataset_disassociate Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…the same zone CVE: CVE-2026-19941 (medium) - Require NSEC wildcard proofs from the same zone Upstream: isc-projects/bind9@ac43c31 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…C downgrade of secure delegati CVE: CVE-2026-77119 (medium) - NSEC3 签名者边界检查漏洞，允许跨域 NSEC3 降级安全委派 Upstream: isc-projects/bind9@f76b344 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
CVE: CVE-2026-75029 (medium) - In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly ... Upstream: https://github.com/isc-projects/bind9/commit/905f6cc0a3f5347eb849b33fdbe4898e2445e47d.patch Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…ve CPU use validating crafted CVE: CVE-2026-19668 (medium) - sec: usr: Prevent excessive CPU use validating crafted DNSSEC responses Upstream: isc-projects/bind9@8d66075 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
CVE: CVE-2026-19668 - 兼容性适配修改：恢复 validator_cancel_finish 和 validate_answer_finish 的前向声明，修复 C11 标准下的隐式函数声明编译错误 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
CVE: CVE-2026-19033 (medium) - Remove support for sparse TSIG - RFC8945 mandates that zone transfers sign each message, but also requires implementations to support sparsely signed transfers for backward compatibility. This backward compatibility measure could be chained with other issues by on-path attackers to execute them with lower privileges. Upstream: https://github.com/isc-projects/bind9/commit/fa351e24e2f97777a3087a9f91998e22cd336deb.patch Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
CVE: CVE-2026-19033 - 兼容性适配修改：删除已移除结构体字段 sincetsig 的残留引用 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
bind9 9.20.23 不提供 dns_name_empty()、DNS_RDATASET_FOREACH() 和 dns_rdataset_cleanup()，而回移的 upstream commit ac43c316 在 lib/dns/validator.c 中引用了它们，导致 -Werror=implicit-function-declaration 编译失败（validator.c:2565/2586）以及 cleanup 标签解析错误。 刷新 CVE-2026-19941.patch，改用本版本已有的等价实现： - dns_name_empty(x) -> dns_name_countlabels(x) == 0 - DNS_RDATASET_FOREACH() -> 显式 dns_rdataset_first()/next() 循环 - dns_rdataset_cleanup() -> dns_rdataset_isassociated() + disassociate()
9.20.23 的 dns_nsec3_noexistnodata() 仍然带有 setclosest 参数（15 个参数）， 而回移的 upstream commit ac43c316 按新签名只传了 14 个，导致 -Werror=implicit-function-declaration 之外还报 too few arguments。 在 checkwildcard() 的 NSEC3 分支调用中补一个 NULL 作为 setclosest。
9.20.23 的 isc/util.h 还没有 CLEANUP() 宏，回移的 upstream commit fa351e24 在 xfrin_recv_done() 中新增了 CLEANUP(DNS_R_EXPECTEDTSIG)， 导致 -Werror=implicit-function-declaration。 展开为等价的 result = DNS_R_EXPECTEDTSIG; goto cleanup;
Contributor
|
/integrate |
|
AutoIntegrationPr Bot |
Several adaptations in this backport set did not preserve upstream behaviour. Fix the ones that change what ships: - CVE-2026-77119: only the label-depth check from upstream patch 2/3 of f76b3440 was backported; the relevance gate was dropped. The depth check is a necessary but not sufficient condition, so a validly signed NSEC3 owned by an unrelated sibling zone (same depth as the queried name's parent) still passed and could downgrade a secure delegation. Add the missing dns_name_getlabelsequence()/dns_name_issubdomain() gate. - CVE-2026-75029: upstream relies on newrdata() resetting a recycled dns_rdata_t, which 9.20.23 does not do. Releasing the skipped duplicate rdata as-is handed a populated rdata to the next dns_message_gettemprdata(), tripping the DNS_RDATA_INITIALIZED requirement in dns_rdata_fromwire() and aborting named on any message that repeats a singleton record and then carries another record. Reset the rdata before returning it to the pool, register tests/dns/message_test in Makefile.am (9.20 builds unit tests with autotools, not meson) and adapt the test to 9.20, which has no isc/lib.h, dns/lib.h or isc_g_mctx. - CVE-2026-81563: dns_rdataset_cleanup() does not exist in 9.20.23; its replacement must keep the dns_rdataset_isassociated() guard, because dns_rdataset_disassociate() requires an associated rdataset. - CVE-2026-19668: restore the per-DS quota charging from upstream patch 3/4 (consume_validation() plus over_max_validations()) and the validation_attempts increment for a DS that did match. - CVE-2026-19941 / CVE-2026-77692: the new system tests used 9.21+ harness APIs (jinja includes, isctest.mark.with_ecdsa_deterministic, isctest.mark.with_libnghttp2) that do not exist in 9.20, so they could not run at all. Spell the options out, use the existing isctest.mark.with_algorithm() helper, and gate the DoH test on libnghttp2 through prereq.sh, the 9.20 way. Verified: all 20 patches apply cleanly to a pristine tree, a full configure && make succeeds, tests/dns/message_test builds and passes, both rewritten named.conf.j2 render and pass named-checkconf, and the new NSEC3 gate rejects the sibling-zone proof while still accepting the genuine parent and grandparent proofs. Log: completed and corrected the CVE backports, including an NSEC3 relevance gate and a parse-path abort introduced by the message.c backport Influence: 1. Validate a zone whose parent DS answer carries a sibling-signed NSEC3 2. Parse queries and responses that repeat a singleton record and then carry more records (named must not abort) 3. Run tests/dns/message_test and the nsec_wildcard_wrong_zone and sig0_https system tests 4. Re-check DNSSEC validation of normal NXDOMAIN, wildcard and NODATA answers 5. Confirm named-checkconf accepts the rewritten system test configurations fix(cve): 补全 9.20.23 安全更新中的 CVE 回移 本次回移中有若干适配没有保持上游行为，修正其中会影响出厂包的部分： - CVE-2026-77119：只回移了上游 f76b3440 patch 2/3 的标签深度判断，漏掉了 相关性判断。深度判断只是必要条件而非充分条件，因此一个由无关同级 zone 合法签名、深度与所查名字父域相同的 NSEC3 仍会通过，可将安全委派降级。 补上缺失的 dns_name_getlabelsequence()/dns_name_issubdomain() 判断。 - CVE-2026-75029：上游依赖 newrdata() 会重置回收的 dns_rdata_t，而 9.20.23 不会。被跳过的重复 rdata 未重置就归还池中，下次 dns_message_gettemprdata() 会拿到已填充的 rdata，触发 dns_rdata_fromwire() 中的 DNS_RDATA_INITIALIZED 断言，导致任何"重复单例记录后还有其他记录"的 报文使 named 中止。归还池前先重置 rdata；同时把 tests/dns/message_test 注册 进 Makefile.am（9.20 单测用 autotools 而非 meson），并适配 9.20（无 isc/lib.h、dns/lib.h、isc_g_mctx）。 - CVE-2026-81563：9.20.23 没有 dns_rdataset_cleanup()，替代实现必须保留 dns_rdataset_isassociated() 保护，因为 dns_rdataset_disassociate() 要求 rdataset 已关联。 - CVE-2026-19668：恢复上游 patch 3/4 的 per-DS 配额计费（consume_validation() 与 over_max_validations()）以及"DS 确实匹配到 DNSKEY"时的 validation_attempts 计数。 - CVE-2026-19941 / CVE-2026-77692：新增 system test 使用了 9.20 不存在的 9.21+ 测试框架 API（jinja include、isctest.mark.with_ecdsa_deterministic、 isctest.mark.with_libnghttp2），完全无法运行。改为展开配置项、使用已有的 isctest.mark.with_algorithm()，并用 9.20 的 prereq.sh 方式限制 libnghttp2。 已验证：20 个补丁在干净树上全部应用成功，完整 configure && make 通过， tests/dns/message_test 编译并通过，两个重写的 named.conf.j2 可渲染且通过 named-checkconf，新的 NSEC3 判断会拒绝同级 zone 的证明，同时仍接受真实父域与 祖父域的证明。 Log: 补全并修正 CVE 回移，包括 NSEC3 相关性判断与 message.c 回移引入的解析中止 Influence: 1. 验证父域 DS 应答中携带同级 zone 签名的 NSEC3 的域 2. 解析"重复单例记录后还有其他记录"的查询与应答（named 不得中止） 3. 运行 tests/dns/message_test 以及 nsec_wildcard_wrong_zone、sig0_https 测试 4. 回归 DNSSEC 对正常 NXDOMAIN、通配符、NODATA 应答的验证 5. 确认 named-checkconf 接受重写后的 system test 配置 repo: bind9 #fix-cve/CVE-2026-76163
Contributor
|
/integrate |
The backport of CVE-2026-19668 kept the DS-by-DNSKEY work bound from upstream 8d660756 patch 3/4, but dropped the other half of the same security merge, upstream patch 2/4 (4927b46245, "Make the exhausted DNSSEC validation quota terminal"). The validator produces ISC_R_QUOTA once the per-fetch validation quota is exhausted, yet nothing consumed it terminally: - fetch_callback_dnskey() and both switches in fetch_callback_ds() fell through to their default arm and relabelled ISC_R_QUOTA as DNS_R_BROKENCHAIN, losing the distinction upstream relies on. - validated() in lib/dns/resolver.c only gave up on DNS_R_BROKENCHAIN, so an exhausted quota fell into fctx_try() and the fetch was retried. Retrying does more validation work against the same, already exhausted quota, which is exactly the CPU use this CVE is about. Restore the missing upstream hunks: let the fetch callbacks pass ISC_R_CANCELED, ISC_R_SHUTTINGDOWN and ISC_R_QUOTA through unchanged, and treat those results, like DNS_R_BROKENCHAIN, as terminal in validated() so the fetch is not retried. The additions match the released 9.20 branch (v9.20.29) for fetch_callback_dnskey() and both fetch_callback_ds() arms; in validated() the released 9.20 branch already carries the upstream switch form, so the equivalent condition is expressed in the if/else-if chain this version uses. Log: restored the terminal handling of an exhausted DNSSEC validation quota Influence: 1. Validate a zone whose parent DS RRset is flooded with mismatched DS records and confirm the query stops instead of retrying the fetch 2. Check named logs "maximum number of validations exceeded" rather than "broken trust chain" when the per-fetch quota is reached 3. Re-run the dnssec system test to confirm ordinary validation is unaffected 4. Confirm a canceled or shutting-down validation still aborts promptly 5. Verify the full patch series applies to a pristine 9.20.23 tree and the package builds fix(cve): CVE-2026-19668 - 让耗尽的验证配额成为终止性错误 CVE-2026-19668 的回移保留了上游 8d660756 patch 3/4 的 DS×DNSKEY 工作量 上界，却漏掉了同一次安全合并里的另一半，即上游 patch 2/4 （4927b46245，"Make the exhausted DNSSEC validation quota terminal"）。 验证器在 per-fetch 验证配额耗尽后会产出 ISC_R_QUOTA，但没有任何地方 把它当作终止性结果： - fetch_callback_dnskey() 和 fetch_callback_ds() 的两个 switch 都会落到 default 分支，把 ISC_R_QUOTA 改写成 DNS_R_BROKENCHAIN，丢掉了上游 依赖的这一区分。 - lib/dns/resolver.c 的 validated() 只对 DNS_R_BROKENCHAIN 放弃重试， 于是配额耗尽会落入 fctx_try() 重试该次 fetch。重试会对同一份已经耗尽 的配额做更多验证工作，而这正是本 CVE 要防的 CPU 消耗。 补回上游遗漏的 hunk：让两个 fetch 回调把 ISC_R_CANCELED、 ISC_R_SHUTTINGDOWN、ISC_R_QUOTA 原样传出，并在 validated() 里把这三个 结果与 DNS_R_BROKENCHAIN 一并视为终止，不再重试 fetch。 新增内容与已发布的 9.20 分支（v9.20.29）的 fetch_callback_dnskey() 及 fetch_callback_ds() 两个分支逐字一致；validated() 在 9.20 分支上已经是 上游的 switch 写法，本版本用的是 if/else-if 链，故以等价条件表达。 Log: 恢复耗尽的 DNSSEC 验证配额应终止而非重试的处理 Influence: 1. 验证父域 DS 记录集被大量不匹配 DS 灌水的域，确认查询会停止而不是 反复重试 fetch 2. 确认达到 per-fetch 配额时 named 日志显示 "maximum number of validations exceeded" 而非 "broken trust chain" 3. 重跑 dnssec system test，确认正常验证流程没有回归 4. 确认被取消或正在关闭的验证仍能立即中止 5. 确认整条补丁链能在干净的 9.20.23 树上应用且包能构建 repo: bind9 #fix-cve/CVE-2026-76163
Contributor
|
/integrate |
Contributor
|
/test ai-review |
Contributor
Author
deepin pr auto reviewAI 代码审查报告
总体评价
修改文件清单
维度1：语法逻辑（25/25）✓ 语法正确，逻辑清晰
维度2：代码质量（24/25）✓ 代码结构清晰，注释完整
维度3：代码性能（20/20）✓ 性能良好，资源使用合理
维度4：代码安全（30/30）✓ 存在0个安全漏洞
安全扫描发现核实（均为误报，不计入漏洞）：
本次 PR 实际安全增强（漏洞修复，非新引入）：
改进建议
审查结论
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE: CVE-2026-76163 (high) - If BIND is loaded with a named.conf file that contains no global options block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit.
Upstream: isc-projects/bind9@4a48f9b73f
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-77692 (high) - 修复使用 SIG(0) 的 HTTPS 未认证崩溃漏洞
Upstream: https://github.com/isc-projects/bind9/commit/d1c25323509173e4d65785e1d1781de77bf461a6.patch
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-19666 (high) - On a resolver configured to use dns64, if an applicable answer from the authoritative server is malformed in a specific way, the resolver named process will exit unexpectedly.
Upstream: isc-projects/bind9@9ddfd2e4da7374ab2f6eaa67cd48d99116a8f60e,https://github.com/isc-projects/bind9/commit/bc4a9ce4d3940f1c5f02f885253e7fbe201de7c4
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-81563 - 兼容性适配修改：将不存在的 dns_rdataset_cleanup 替换为已有的 dns_rdataset_disassociate
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-19941 (medium) - Require NSEC wildcard proofs from the same zone
Upstream: isc-projects/bind9@ac43c31
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-77119 (medium) - NSEC3 签名者边界检查漏洞，允许跨域 NSEC3 降级安全委派
Upstream: isc-projects/bind9@f76b344
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-75029 (medium) - In a query response, an attacker may send
namedmultiple copies of a record that should only exist once (such as an SOA record). If the RDATA is the same on all the copies, the record is appended to the in-memory RDATA set, which can cause increased memory usage of the negative cache and possibly ...Upstream: https://github.com/isc-projects/bind9/commit/905f6cc0a3f5347eb849b33fdbe4898e2445e47d.patch
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-19668 - 兼容性适配修改：恢复 validator_cancel_finish 和 validate_answer_finish 的前向声明，修复 C11 标准下的隐式函数声明编译错误
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-19033 - 兼容性适配修改：删除已移除结构体字段 sincetsig 的残留引用
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b