Skip to content

Commit 42108e7

Browse files
jykanasejslobodzian
jykanase
and
jslobodzian
authored
[High] Patch dhcp for CVE-2024-11187 (microsoft#15079)
Co-authored-by: jslobodzian <[email protected]>
1 parent b0abeb7 commit 42108e7

File tree

2 files changed

+212
-1
lines changed

2 files changed

+212
-1
lines changed

‎SPECS/dhcp/CVE-2024-11187.patch‎

Lines changed: 207 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,207 @@
1+
From 965e9d69716e3ec8a9366eafe9c34da8d2ba4483 Mon Sep 17 00:00:00 2001
2+
From: jykanase <[email protected]>
3+
Date: Thu, 13 Nov 2025 04:12:51 +0000
4+
Subject: [PATCH] CVE-2024-11187
5+
6+
Upstream Patch Reference:https://git.rockylinux.org/staging/rpms/bind/-/blob/r8/SOURCES/bind-9.18-CVE-2024-11187-pre-test.patch
7+
https://git.rockylinux.org/staging/rpms/bind/-/blob/r8/SOURCES/bind-9.18-CVE-2024-11187.patch
8+
---
9+
bind/bind-9.11.36/bin/named/query.c | 14 ++++++++------
10+
.../bin/tests/system/additional/tests.sh | 2 +-
11+
bind/bind-9.11.36/bin/tests/system/conf.sh.in | 12 ++++++++++++
12+
.../bin/tests/system/resolver/ns4/named.noaa | 5 -----
13+
.../bin/tests/system/resolver/tests.sh | 8 ++++++++
14+
bind/bind-9.11.36/lib/dns/include/dns/rdataset.h | 12 ++++++++++++
15+
bind/bind-9.11.36/lib/dns/rdataset.c | 12 ++++++++++++
16+
7 files changed, 53 insertions(+), 12 deletions(-)
17+
delete mode 100644 bind/bind-9.11.36/bin/tests/system/resolver/ns4/named.noaa
18+
19+
diff --git a/bind/bind-9.11.36/bin/named/query.c b/bind/bind-9.11.36/bin/named/query.c
20+
index f109805..512a669 100644
21+
--- a/bind/bind-9.11.36/bin/named/query.c
22+
+++ b/bind/bind-9.11.36/bin/named/query.c
23+
@@ -1825,9 +1825,10 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
24+
* section, it's helpful if we add the SRV additional data
25+
* as well.
26+
*/
27+
- eresult = dns_rdataset_additionaldata(trdataset,
28+
- query_addadditional,
29+
- client);
30+
+ eresult = dns_rdataset_additionaldata2(trdataset,
31+
+ query_addadditional,
32+
+ client,
33+
+ DNS_RDATASET_MAXADDITIONAL);
34+
}
35+
36+
cleanup:
37+
@@ -2422,7 +2423,7 @@ query_addrdataset(ns_client_t *client, dns_name_t *fname,
38+
rdataset->rdclass);
39+
rdataset->attributes |= DNS_RDATASETATTR_LOADORDER;
40+
41+
- if (NOADDITIONAL(client))
42+
+ if (NOADDITIONAL(client) || client->query.qtype == dns_rdatatype_any)
43+
return;
44+
45+
/*
46+
@@ -2432,8 +2433,9 @@ query_addrdataset(ns_client_t *client, dns_name_t *fname,
47+
*/
48+
additionalctx.client = client;
49+
additionalctx.rdataset = rdataset;
50+
- (void)dns_rdataset_additionaldata(rdataset, query_addadditional2,
51+
- &additionalctx);
52+
+ (void)dns_rdataset_additionaldata2(rdataset, query_addadditional2,
53+
+ &additionalctx,
54+
+ DNS_RDATASET_MAXADDITIONAL);
55+
CTRACE(ISC_LOG_DEBUG(3), "query_addrdataset: done");
56+
}
57+
58+
diff --git a/bind/bind-9.11.36/bin/tests/system/additional/tests.sh b/bind/bind-9.11.36/bin/tests/system/additional/tests.sh
59+
index 6400723..a33cc8a 100644
60+
--- a/bind/bind-9.11.36/bin/tests/system/additional/tests.sh
61+
+++ b/bind/bind-9.11.36/bin/tests/system/additional/tests.sh
62+
@@ -261,7 +261,7 @@ n=`expr $n + 1`
63+
echo_i "testing with 'minimal-any no;' ($n)"
64+
ret=0
65+
$DIG $DIGOPTS -t ANY www.rt.example @10.53.0.1 > dig.out.$n || ret=1
66+
-grep "ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 2" dig.out.$n > /dev/null || ret=1
67+
+grep "ANSWER: 3, AUTHORITY: 1, ADDITIONAL: 1" dig.out.$n > /dev/null || ret=1
68+
if [ $ret -eq 1 ] ; then
69+
echo_i "failed"; status=`expr status + 1`
70+
fi
71+
diff --git a/bind/bind-9.11.36/bin/tests/system/conf.sh.in b/bind/bind-9.11.36/bin/tests/system/conf.sh.in
72+
index 85792a9..d5a1024 100644
73+
--- a/bind/bind-9.11.36/bin/tests/system/conf.sh.in
74+
+++ b/bind/bind-9.11.36/bin/tests/system/conf.sh.in
75+
@@ -305,6 +305,18 @@ digcomp() {
76+
return $result
77+
}
78+
79+
+start_server() {
80+
+ $PERL "$SYSTEMTESTTOP/start.pl" "$SYSTESTDIR" "$@"
81+
+}
82+
+
83+
+stop_server() {
84+
+ $PERL "$SYSTEMTESTTOP/stop.pl" "$SYSTESTDIR" "$@"
85+
+}
86+
+
87+
+send() {
88+
+ $PERL "$SYSTEMTESTTOP/send.pl" "$@"
89+
+}
90+
+
91+
#
92+
# Useful functions in test scripts
93+
#
94+
diff --git a/bind/bind-9.11.36/bin/tests/system/resolver/ns4/named.noaa b/bind/bind-9.11.36/bin/tests/system/resolver/ns4/named.noaa
95+
deleted file mode 100644
96+
index 3b121ad..0000000
97+
--- a/bind/bind-9.11.36/bin/tests/system/resolver/ns4/named.noaa
98+
+++ /dev/null
99+
@@ -1,5 +0,0 @@
100+
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
101+
-
102+
-See COPYRIGHT in the source root or https://isc.org/copyright.html for terms.
103+
-
104+
-Add -T noaa.
105+
diff --git a/bind/bind-9.11.36/bin/tests/system/resolver/tests.sh b/bind/bind-9.11.36/bin/tests/system/resolver/tests.sh
106+
index 6eb52fe..bf37467 100755
107+
--- a/bind/bind-9.11.36/bin/tests/system/resolver/tests.sh
108+
+++ b/bind/bind-9.11.36/bin/tests/system/resolver/tests.sh
109+
@@ -281,6 +281,10 @@ done
110+
if [ $ret != 0 ]; then echo_i "failed"; fi
111+
status=`expr $status + $ret`
112+
113+
+stop_server ns4
114+
+touch ns4/named.noaa
115+
+start_server --noclean --restart --port ${PORT} ns4 || ret=1
116+
+
117+
n=`expr $n + 1`
118+
echo_i "RT21594 regression test check setup ($n)"
119+
ret=0
120+
@@ -317,6 +321,10 @@ grep "status: NXDOMAIN" dig.ns5.out.${n} > /dev/null || ret=1
121+
if [ $ret != 0 ]; then echo_i "failed"; fi
122+
status=`expr $status + $ret`
123+
124+
+stop_server ns4
125+
+rm ns4/named.noaa
126+
+start_server --noclean --restart --port ${PORT} ns4 || ret=1
127+
+
128+
n=`expr $n + 1`
129+
echo_i "check that replacement of additional data by a negative cache no data entry clears the additional RRSIGs ($n)"
130+
ret=0
131+
diff --git a/bind/bind-9.11.36/lib/dns/include/dns/rdataset.h b/bind/bind-9.11.36/lib/dns/include/dns/rdataset.h
132+
index ed9119a..162118a 100644
133+
--- a/bind/bind-9.11.36/lib/dns/include/dns/rdataset.h
134+
+++ b/bind/bind-9.11.36/lib/dns/include/dns/rdataset.h
135+
@@ -53,6 +53,8 @@
136+
#include <dns/types.h>
137+
#include <dns/rdatastruct.h>
138+
139+
+#define DNS_RDATASET_MAXADDITIONAL 13
140+
+
141+
ISC_LANG_BEGINDECLS
142+
143+
typedef enum {
144+
@@ -490,13 +492,23 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
145+
*\li If a call to dns_rdata_additionaldata() is not successful, the
146+
* result returned will be the result of dns_rdataset_additionaldata().
147+
*
148+
+ *\li If 'limit' is non-zero and the number of the rdatasets is larger
149+
+ * than 'limit', no additional data will be processed.
150+
+ *
151+
* Returns:
152+
*
153+
*\li #ISC_R_SUCCESS
154+
*
155+
+ *\li #DNS_R_TOOMANYRECORDS in case rdataset count is larger than 'limit'
156+
+ *
157+
*\li Any error that dns_rdata_additionaldata() can return.
158+
*/
159+
160+
+isc_result_t
161+
+dns_rdataset_additionaldata2(dns_rdataset_t *rdataset,
162+
+ dns_additionaldatafunc_t add, void *arg,
163+
+ size_t limit);
164+
+
165+
isc_result_t
166+
dns_rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
167+
dns_rdataset_t *neg, dns_rdataset_t *negsig);
168+
diff --git a/bind/bind-9.11.36/lib/dns/rdataset.c b/bind/bind-9.11.36/lib/dns/rdataset.c
169+
index b42dea5..5160acf 100644
170+
--- a/bind/bind-9.11.36/lib/dns/rdataset.c
171+
+++ b/bind/bind-9.11.36/lib/dns/rdataset.c
172+
@@ -28,6 +28,7 @@
173+
#include <dns/ncache.h>
174+
#include <dns/rdata.h>
175+
#include <dns/rdataset.h>
176+
+#include <dns/result.h>
177+
178+
static const char *trustnames[] = {
179+
"none",
180+
@@ -608,6 +609,13 @@ dns_rdataset_towire(dns_rdataset_t *rdataset,
181+
isc_result_t
182+
dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
183+
dns_additionaldatafunc_t add, void *arg)
184+
+{
185+
+ return dns_rdataset_additionaldata2(rdataset, add, arg, 0);
186+
+}
187+
+
188+
+isc_result_t
189+
+dns_rdataset_additionaldata2(dns_rdataset_t *rdataset,
190+
+ dns_additionaldatafunc_t add, void *arg, size_t limit)
191+
{
192+
dns_rdata_t rdata = DNS_RDATA_INIT;
193+
isc_result_t result;
194+
@@ -620,6 +628,10 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
195+
REQUIRE(DNS_RDATASET_VALID(rdataset));
196+
REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0);
197+
198+
+ if (limit != 0 && dns_rdataset_count(rdataset) > limit) {
199+
+ return DNS_R_TOOMANYRECORDS;
200+
+ }
201+
+
202+
result = dns_rdataset_first(rdataset);
203+
if (result != ISC_R_SUCCESS)
204+
return (result);
205+
--
206+
2.45.4
207+

‎SPECS/dhcp/dhcp.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Dynamic host configuration protocol
22
Name: dhcp
33
Version: 4.4.3.P1
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: MPLv2.0
66
Url: https://www.isc.org/dhcp/
77
Source0: https://downloads.isc.org/isc/dhcp/4.4.3-P1/dhcp-4.4.3-P1.tar.gz
@@ -15,6 +15,7 @@ Patch2: CVE-2022-2795.patch
1515
Patch3: CVE-2023-2828.patch
1616
Patch4: CVE-2024-1737.patch
1717
Patch5: CVE-2024-1975.patch
18+
Patch6: CVE-2024-11187.patch
1819

1920
%description
2021
The ISC DHCP package contains both the client and server programs for DHCP. dhclient (the client) is used for connecting to a network which uses DHCP to assign network addresses. dhcpd (the server) is used for assigning network addresses on private networks
@@ -182,6 +183,9 @@ mkdir -p %{buildroot}%{_localstatedir}/lib/dhclient/
182183
%{_mandir}/man8/dhclient.8.gz
183184

184185
%changelog
186+
* Thu Nov 13 2025 Jyoti Kanase <[email protected]> - 4.4.3-p1-3
187+
- Patch for CVE-2024-11187
188+
185189
* Mon Jul 29 2024 Sumedh Sharma <[email protected]> - 4.4.3-P1-2
186190
- Add patch for CVE-2024-1737 & CVE-2024-1975 in bundled bind-9
187191
- Apply old patches meant for bundled bind-9

0 commit comments

Comments
 (0)