]> git.ipfire.org Git - thirdparty/bind9.git/commit
fix: usr: Fix read UAF in BIND9 dns_client_resolve() via DNAME Response
authorOndřej Surý <ondrej@isc.org>
Fri, 20 Feb 2026 11:51:41 +0000 (12:51 +0100)
committerOndřej Surý <ondrej@isc.org>
Fri, 20 Feb 2026 11:51:41 +0000 (12:51 +0100)
commit254d41f733d94dfb17c2c60006b4fbf6d17b4f96
tree44d543b91b98f1236ad13959374e352dcd04b667
parent68826a9f6cb16e3c49126fb2509a3cc6e7edcaf7
parent9135b71a7aca1a2dca994e959fad2e4f22e3f983
fix: usr: Fix read UAF in BIND9 dns_client_resolve() via DNAME Response

An attacker controlling a malicious DNS server returns a DNAME record,
and the we stores a pointer to resp->foundname, frees the response
structure, then uses the dangling pointer in dns_name_fullcompare()
possibly causing invalid match.  Only the `delv`is affected.  This has
been fixed.

Closes #5728

Merge branch '5728-heap-uaf-in-bind9-dns_client_resolve-via-dname-response' into 'main'

See merge request isc-projects/bind9!11570