From 12bf9875588293b3de0df04ace6ea8dbd7a18f5f Mon Sep 17 00:00:00 2001 From: zhangxianting Date: Thu, 25 Jul 2024 18:06:34 +0800 Subject: [PATCH] fix CVE-2024-1975 --- backport-CVE-2024-1975-1.patch | 145 +++++++++++++++++++++++++++++++ backport-CVE-2024-1975-2.patch | 154 +++++++++++++++++++++++++++++++++ backport-CVE-2024-1975-3.patch | 69 +++++++++++++++ backport-CVE-2024-1975-4.patch | 48 ++++++++++ backport-CVE-2024-1975-5.patch | 26 ++++++ bind.spec | 21 ++++- 6 files changed, 462 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2024-1975-1.patch create mode 100644 backport-CVE-2024-1975-2.patch create mode 100644 backport-CVE-2024-1975-3.patch create mode 100644 backport-CVE-2024-1975-4.patch create mode 100644 backport-CVE-2024-1975-5.patch diff --git a/backport-CVE-2024-1975-1.patch b/backport-CVE-2024-1975-1.patch new file mode 100644 index 0000000..11bdd2a --- /dev/null +++ b/backport-CVE-2024-1975-1.patch @@ -0,0 +1,145 @@ +From bef3d2cca3552100bbe44790c8c1a4f5bef06798 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= +Date: Thu, 16 May 2024 12:10:41 +0200 +Subject: [PATCH] Remove support for SIG(0) message verification +https://github.com/isc-projects/bind9/commit/bef3d2cca3552100bbe44790c8c1a4f5bef06798 + +--- + bin/named/client.c | 7 +++ + lib/dns/message.c | 91 +++------------------------------------ + 2 files changed, 13 insertions(+), 85 deletions(-) + +diff --git a/bin/named/client.c b/bin/named/client.c +index baa9ef9..22eacd6 100644 +--- a/bin/named/client.c ++++ b/bin/named/client.c +@@ -2984,6 +2984,13 @@ client_request(isc_task_t *task, isc_event_t *event) { + ns_client_log(client, DNS_LOGCATEGORY_SECURITY, + NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3), + "request is signed by a nonauthoritative key"); ++ } else if (result == DNS_R_NOTVERIFIEDYET && ++ client->message->sig0 != NULL) ++ { ++ ns_client_log(client, DNS_LOGCATEGORY_SECURITY, ++ NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3), ++ "request has a SIG(0) signature but its support " ++ "was removed (CVE-2024-1975)"); + } else { + char tsigrcode[64]; + isc_buffer_t b; +diff --git a/lib/dns/message.c b/lib/dns/message.c +index 0d94250..20f306b 100644 +--- a/lib/dns/message.c ++++ b/lib/dns/message.c +@@ -3214,102 +3214,23 @@ dns_message_dumpsig(dns_message_t *msg, char *txt1) { + + isc_result_t + dns_message_checksig(dns_message_t *msg, dns_view_t *view) { +- isc_buffer_t b, msgb; ++ isc_buffer_t msgb; + + REQUIRE(DNS_MESSAGE_VALID(msg)); + +- if (msg->tsigkey == NULL && msg->tsig == NULL && msg->sig0 == NULL) ++ if (msg->tsigkey == NULL && msg->tsig == NULL) + return (ISC_R_SUCCESS); + + INSIST(msg->saved.base != NULL); + isc_buffer_init(&msgb, msg->saved.base, msg->saved.length); + isc_buffer_add(&msgb, msg->saved.length); +- if (msg->tsigkey != NULL || msg->tsig != NULL) { + #ifdef SKAN_MSG_DEBUG +- dns_message_dumpsig(msg, "dns_message_checksig#1"); ++ dns_message_dumpsig(msg, "dns_message_checksig#1"); + #endif +- if (view != NULL) +- return (dns_view_checksig(view, &msgb, msg)); +- else +- return (dns_tsig_verify(&msgb, msg, NULL, NULL)); ++ if (view != NULL) { ++ return (dns_view_checksig(view, &msgb, msg)); + } else { +- dns_rdata_t rdata = DNS_RDATA_INIT; +- dns_rdata_sig_t sig; +- dns_rdataset_t keyset; +- isc_result_t result; +- +- result = dns_rdataset_first(msg->sig0); +- INSIST(result == ISC_R_SUCCESS); +- dns_rdataset_current(msg->sig0, &rdata); +- +- /* +- * This can occur when the message is a dynamic update, since +- * the rdata length checking is relaxed. This should not +- * happen in a well-formed message, since the SIG(0) is only +- * looked for in the additional section, and the dynamic update +- * meta-records are in the prerequisite and update sections. +- */ +- if (rdata.length == 0) +- return (ISC_R_UNEXPECTEDEND); +- +- result = dns_rdata_tostruct(&rdata, &sig, msg->mctx); +- if (result != ISC_R_SUCCESS) +- return (result); +- +- dns_rdataset_init(&keyset); +- if (view == NULL) +- return (DNS_R_KEYUNAUTHORIZED); +- result = dns_view_simplefind(view, &sig.signer, +- dns_rdatatype_key /* SIG(0) */, +- 0, 0, false, &keyset, NULL); +- +- if (result != ISC_R_SUCCESS) { +- /* XXXBEW Should possibly create a fetch here */ +- result = DNS_R_KEYUNAUTHORIZED; +- goto freesig; +- } else if (keyset.trust < dns_trust_secure) { +- /* XXXBEW Should call a validator here */ +- result = DNS_R_KEYUNAUTHORIZED; +- goto freesig; +- } +- result = dns_rdataset_first(&keyset); +- INSIST(result == ISC_R_SUCCESS); +- for (; +- result == ISC_R_SUCCESS; +- result = dns_rdataset_next(&keyset)) +- { +- dst_key_t *key = NULL; +- +- dns_rdata_reset(&rdata); +- dns_rdataset_current(&keyset, &rdata); +- isc_buffer_init(&b, rdata.data, rdata.length); +- isc_buffer_add(&b, rdata.length); +- +- result = dst_key_fromdns(&sig.signer, rdata.rdclass, +- &b, view->mctx, &key); +- if (result != ISC_R_SUCCESS) +- continue; +- if (dst_key_alg(key) != sig.algorithm || +- dst_key_id(key) != sig.keyid || +- !(dst_key_proto(key) == DNS_KEYPROTO_DNSSEC || +- dst_key_proto(key) == DNS_KEYPROTO_ANY)) +- { +- dst_key_free(&key); +- continue; +- } +- result = dns_dnssec_verifymessage(&msgb, msg, key); +- dst_key_free(&key); +- if (result == ISC_R_SUCCESS) +- break; +- } +- if (result == ISC_R_NOMORE) +- result = DNS_R_KEYUNAUTHORIZED; +- +- freesig: +- if (dns_rdataset_isassociated(&keyset)) +- dns_rdataset_disassociate(&keyset); +- dns_rdata_freestruct(&sig); +- return (result); ++ return (dns_tsig_verify(&msgb, msg, NULL, NULL)); + } + } + +-- +2.33.0 + diff --git a/backport-CVE-2024-1975-2.patch b/backport-CVE-2024-1975-2.patch new file mode 100644 index 0000000..938d395 --- /dev/null +++ b/backport-CVE-2024-1975-2.patch @@ -0,0 +1,154 @@ +From 33007e302d2e5b4550fa8c9d5cd1bffaaffb6819 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= +Date: Thu, 16 May 2024 12:15:23 +0200 +Subject: [PATCH] Document SIG(0) verification removal +https://github.com/isc-projects/bind9/commit/33007e302d2e5b4550fa8c9d5cd1bffaaffb6819 + +--- + doc/arm/Bv9ARM-book.xml | 24 ++++-------------------- + doc/arm/Bv9ARM-book.xml.rt46047 | 4 ++-- + doc/arm/Bv9ARM-book.xml.serve-stale | 4 ++-- + doc/arm/Bv9ARM.ch06.html | 2 +- + doc/arm/Bv9ARM.ch07.html | 2 +- + doc/misc/rfc-compliance | 6 ++---- + 6 files changed, 12 insertions(+), 30 deletions(-) + +diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml +index 055d65d..a9463f8 100644 +--- a/doc/arm/Bv9ARM-book.xml ++++ b/doc/arm/Bv9ARM-book.xml +@@ -2040,24 +2040,8 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;}; +
SIG(0) + + +- BIND partially supports DNSSEC SIG(0) +- transaction signatures as specified in RFC 2535 and RFC 2931. +- SIG(0) uses public/private keys to authenticate messages. Access control +- is performed in the same manner as TSIG keys; privileges can be +- granted or denied in ACL directives based on the key name. +- +- +- When a SIG(0) signed message is received, it will only be +- verified if the key is known and trusted by the server. The +- server will not attempt to recursively fetch or validate the +- key. +- +- +- SIG(0) signing of multiple-message TCP streams is not supported. +- +- +- The only tool shipped with BIND 9 that +- generates SIG(0) signed messages is nsupdate. ++ Support for DNSSEC SIG(0) transaction signatures has been removed. ++ This is a countermeasure for CVE-2024-1975. + +
+ +@@ -12578,7 +12562,7 @@ example.com. NS ns2.example.net. + either grants or denies permission for one or more + names in the zone to be updated by one or more + identities. Identity is determined by the key that +- signed the update request using either TSIG or SIG(0). ++ signed the update request using TSIG. + In most cases, update-policy rules + only apply to key-based identities. There is no way + to specify update permissions based on client source +@@ -16893,7 +16877,7 @@ HOST-127.EXAMPLE. MX 0 . + + + ACLs match clients on the basis of up to three characteristics: +- 1) The client's IP address; 2) the TSIG or SIG(0) key that was ++ 1) The client's IP address; 2) the TSIG key that was + used to sign the request, if any; and 3) an address prefix + encoded in an EDNS Client Subnet option, if any. + +diff --git a/doc/arm/Bv9ARM-book.xml.rt46047 b/doc/arm/Bv9ARM-book.xml.rt46047 +index 02fc038..acab43a 100644 +--- a/doc/arm/Bv9ARM-book.xml.rt46047 ++++ b/doc/arm/Bv9ARM-book.xml.rt46047 +@@ -12494,7 +12494,7 @@ example.com. NS ns2.example.net. + either grants or denies permission for one or more + names in the zone to be updated by one or more + identities. Identity is determined by the key that +- signed the update request using either TSIG or SIG(0). ++ signed the update request using TSIG. + In most cases, update-policy rules + only apply to key-based identities. There is no way + to specify update permissions based on client source +@@ -16809,7 +16809,7 @@ HOST-127.EXAMPLE. MX 0 . + + + ACLs match clients on the basis of up to three characteristics: +- 1) The client's IP address; 2) the TSIG or SIG(0) key that was ++ 1) The client's IP address; 2) the TSIG key that was + used to sign the request, if any; and 3) an address prefix + encoded in an EDNS Client Subnet option, if any. + +diff --git a/doc/arm/Bv9ARM-book.xml.serve-stale b/doc/arm/Bv9ARM-book.xml.serve-stale +index cbad93a..e07d66c 100644 +--- a/doc/arm/Bv9ARM-book.xml.serve-stale ++++ b/doc/arm/Bv9ARM-book.xml.serve-stale +@@ -12517,7 +12517,7 @@ example.com. NS ns2.example.net. + either grants or denies permission for one or more + names in the zone to be updated by one or more + identities. Identity is determined by the key that +- signed the update request using either TSIG or SIG(0). ++ signed the update request using TSIG. + In most cases, update-policy rules + only apply to key-based identities. There is no way + to specify update permissions based on client source +@@ -16832,7 +16832,7 @@ HOST-127.EXAMPLE. MX 0 . + + + ACLs match clients on the basis of up to three characteristics: +- 1) The client's IP address; 2) the TSIG or SIG(0) key that was ++ 1) The client's IP address; 2) the TSIG key that was + used to sign the request, if any; and 3) an address prefix + encoded in an EDNS Client Subnet option, if any. + +diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html +index cdd1a4f..697f658 100644 +--- a/doc/arm/Bv9ARM.ch06.html ++++ b/doc/arm/Bv9ARM.ch06.html +@@ -10341,7 +10341,7 @@ example.com. NS ns2.example.net. + either grants or denies permission for one or more + names in the zone to be updated by one or more + identities. Identity is determined by the key that +- signed the update request using either TSIG or SIG(0). ++ signed the update request using TSIG. + In most cases, update-policy rules + only apply to key-based identities. There is no way + to specify update permissions based on client source +diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html +index 2e0ca88..cfe9430 100644 +--- a/doc/arm/Bv9ARM.ch07.html ++++ b/doc/arm/Bv9ARM.ch07.html +@@ -71,7 +71,7 @@ +

+

+ ACLs match clients on the basis of up to three characteristics: +- 1) The client's IP address; 2) the TSIG or SIG(0) key that was ++ 1) The client's IP address; 2) the TSIG key that was + used to sign the request, if any; and 3) an address prefix + encoded in an EDNS Client Subnet option, if any. +

+diff --git a/doc/misc/rfc-compliance b/doc/misc/rfc-compliance +index 80763b8..74c512e 100644 +--- a/doc/misc/rfc-compliance ++++ b/doc/misc/rfc-compliance +@@ -130,10 +130,8 @@ feature. + and NXTs in responses rather than relying on the resolving server + to perform separate queries for missing SIGs and NXTs. + +-[5] When receiving a query signed with a SIG(0), the server will +-only be able to verify the signature if it has the key in its local +-authoritative data; it will not do recursion or validation to +-retrieve unknown keys. ++[5] Support for SIG(0) message verification was removed ++as part of the mitigation of CVE-2024-1975. + + [6] Section 4 is ignored. + +-- +2.33.0 + diff --git a/backport-CVE-2024-1975-3.patch b/backport-CVE-2024-1975-3.patch new file mode 100644 index 0000000..eb320ef --- /dev/null +++ b/backport-CVE-2024-1975-3.patch @@ -0,0 +1,69 @@ +From 02dffb63a84662b19da4e0efda26e061676f85a8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= +Date: Fri, 17 May 2024 12:23:05 +0200 +Subject: [PATCH] Adapt the tsiggss test to the SIG(0) removal +https://github.com/isc-projects/bind9/commit/02dffb63a84662b19da4e0efda26e061676f85a8 + +Test that SIG(0) signer is NOT sent to the external socket for +authorization. It MUST NOT be considered a valid signature by +any chance. + +Also check that the signer's name does not appear in authsock.pl +output. +--- + bin/tests/system/tsiggss/authsock.pl | 1 + + bin/tests/system/tsiggss/tests.sh | 12 +++++++----- + 2 files changed, 8 insertions(+), 5 deletions(-) + +diff --git a/bin/tests/system/tsiggss/authsock.pl b/bin/tests/system/tsiggss/authsock.pl +index 57a72b2..75a084c 100644 +--- a/bin/tests/system/tsiggss/authsock.pl ++++ b/bin/tests/system/tsiggss/authsock.pl +@@ -48,6 +48,7 @@ if ($timeout != 0) { + } + + while (my $client = $server->accept()) { ++ printf("accept()\n"); + $client->recv(my $buf, 8, 0); + my ($version, $req_len) = unpack('N N', $buf); + +diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh +index e4c32dc..2d67533 100644 +--- a/bin/tests/system/tsiggss/tests.sh ++++ b/bin/tests/system/tsiggss/tests.sh +@@ -116,7 +116,7 @@ status=$((status+ret)) + + echo "I:testing external update policy (CNAME) with auth sock ($n)" + ret=0 +-$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 > /dev/null 2>&1 & ++$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 > authsock.log 2>&1 & + sleep 1 + test_update $n testcname.example.nil. CNAME "86400 CNAME testdenied.example.nil" "testdenied" || ret=1 + n=$((n+1)) +@@ -130,17 +130,19 @@ n=$((n+1)) + if [ "$ret" -ne 0 ]; then echo_i "failed"; fi + status=$((status+ret)) + +-echo "I:testing external policy with SIG(0) key ($n)" ++echo "I:testing external policy with unsupported SIG(0) key ($n)" + ret=0 +-$NSUPDATE -R $RANDFILE -k ns1/Kkey.example.nil.*.private < /dev/null 2>&1 || ret=1 ++$NSUPDATE -R $RANDFILE -d -k ns1/Kkey.example.nil.*.private < nsupdate.out${n} 2>&1 || true ++debug + server 10.53.0.1 ${PORT} + zone example.nil + update add fred.example.nil 120 cname foo.bar. + send + END + output=`$DIG $DIGOPTS +short cname fred.example.nil.` +-[ -n "$output" ] || ret=1 +-[ $ret -eq 0 ] || echo "I:failed" ++# update must have failed - SIG(0) signer is not supported ++[ -n "$output" ] && ret=1 ++grep -F "signer=key.example.nil" authsock.log >/dev/null && ret=1 + n=$((n+1)) + if [ "$ret" -ne 0 ]; then echo_i "failed"; fi + status=$((status+ret)) +-- +2.33.0 + diff --git a/backport-CVE-2024-1975-4.patch b/backport-CVE-2024-1975-4.patch new file mode 100644 index 0000000..3900155 --- /dev/null +++ b/backport-CVE-2024-1975-4.patch @@ -0,0 +1,48 @@ +From 227f9aa0646cdf521e0db0d472f8bcc1e2bd6154 Mon Sep 17 00:00:00 2001 +From: Aram Sargsyan +Date: Tue, 21 May 2024 09:29:35 +0000 +Subject: [PATCH] Adapt the upforwd test to the SIG(0) removal +https://github.com/isc-projects/bind9/commit/227f9aa0646cdf521e0db0d472f8bcc1e2bd6154 + +Change the check so that update with SIG(0) is expected to fail. +--- + bin/tests/system/upforwd/tests.sh | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh +index 9adae82..ce22785 100644 +--- a/bin/tests/system/upforwd/tests.sh ++++ b/bin/tests/system/upforwd/tests.sh +@@ -177,18 +177,21 @@ n=`expr $n + 1` + + if test -f keyname + then +- echo_i "checking update forwarding to with sig0 ($n)" ++ echo_i "checking update forwarding to with sig0 (expected to fail) ($n)" + ret=0 + keyname=`cat keyname` +- $NSUPDATE -k $keyname.private -- - <nsupdate.out.$n 2>&1 && ret=1 + $DIG -p ${PORT} unsigned.example2 A @10.53.0.1 > dig.out.ns1.test$n +- grep "status: NOERROR" dig.out.ns1.test$n > /dev/null || ret=1 ++ grep "status: NOERROR" dig.out.ns1.test$n > /dev/null && ret=1 + if [ $ret != 0 ] ; then echo_i "failed"; fi + status=`expr $status + $ret` + n=`expr $n + 1` +-- +2.33.0 + diff --git a/backport-CVE-2024-1975-5.patch b/backport-CVE-2024-1975-5.patch new file mode 100644 index 0000000..ee803d5 --- /dev/null +++ b/backport-CVE-2024-1975-5.patch @@ -0,0 +1,26 @@ +From 8acd71b9cc3d46618319f8c2195d857a8f79744b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= +Date: Thu, 6 Jun 2024 17:43:20 +0200 +Subject: [PATCH] Add CHANGES note for [GL #4480] +https://github.com/isc-projects/bind9/commit/8acd71b9cc3d46618319f8c2195d857a8f79744b + +--- + CHANGES | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/CHANGES b/CHANGES +index 557c5a2..2603c14 100644 +--- a/CHANGES ++++ b/CHANGES +@@ -1,5 +1,8 @@ + --- 9.11.21 released --- + ++5459. [security] Remove SIG(0) support from named as a countermeasure ++ for CVE-2024-1975. [GL #4480] ++ + 5458. [bug] Prevent a theoretically possible NULL dereference caused + by a data race between zone_maintenance() and + dns_zone_setview_helper(). [GL #1627] +-- +2.33.0 + diff --git a/bind.spec b/bind.spec index cf7a25e..55d2180 100644 --- a/bind.spec +++ b/bind.spec @@ -19,7 +19,7 @@ Name: bind Summary: Domain Name System (DNS) Server (named) License: MPLv2.0 Version: 9.11.21 -Release: 18 +Release: 19 Epoch: 32 Url: http://www.isc.org/products/BIND/ Source0: https://ftp.isc.org/isc/bind9/9.11.21/bind-%{version}.tar.gz @@ -245,6 +245,13 @@ Patch6069: backport-CVE-2023-2828.patch Patch6070: backport-CVE-2023-3341.patch +# fix CVE-2024-1975 +patch9001:backport-CVE-2024-1975-1.patch +patch9002:backport-CVE-2024-1975-2.patch +patch9003:backport-CVE-2024-1975-3.patch +patch9004:backport-CVE-2024-1975-4.patch +patch9005:backport-CVE-2024-1975-5.patch + %description Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols and provides an openly redistributable reference @@ -528,6 +535,12 @@ cp -a %{SOURCE29} lib/dns/tests/testdata/dstrandom/random.data %patch6069 -p1 %patch6070 -p1 +%patch9001 -p1 +%patch9002 -p1 +%patch9003 -p1 +%patch9004 -p1 +%patch9005 -p1 + %patch199 -p1 %if %{with PKCS11} @@ -1308,6 +1321,12 @@ rm -rf ${RPM_BUILD_ROOT} %changelog +* Thu Jul 25 2024 zhangxianting - 32:9.11.21-19 +- Type:CVE +- CVE:CVE-2024-1975 +- SUG:NA +- DESC:fix CVE-2024-1975 + * Thu Sep 28 2023 sunhai - 32:9.11.21-18 - Type:bugfix - ID:NA -- Gitee