[v9_10_6_patch] prevent use-after-free

4858.	[security]	Addresses could be referenced after being freed
			in resolver.c, causing an assertion failure.
			(CVE-2017-3145) [RT #46839]

diff --git a/CHANGES b/CHANGES
index 210b012bac713b7afe24cf112a0548aaa573e235..c2b70468a5d7b24d0591b72b0198c62ba5bd2d81 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+       --- 9.10.6-P1 released ---
+
+4858.  [security]      Addresses could be referenced after being freed
+                       in resolver.c, causing an assertion failure.
+                       (CVE-2017-3145) [RT #46839]
+
        --- 9.10.6 released ---
 
        --- 9.10.6rc2 released ---

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 45d6c4cd7f4ea584d0e71ba973131ba48ee68e9b..a42651b4d10d328cf34ed28df9c4b5aa363900e2 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -21,10 +21,11 @@
   <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="noteversion.xml"/>
   <section xml:id="relnotes_intro"><info><title>Introduction</title></info>
     <para>
-      This document summarizes changes since the last production
-      release on the BIND 9.10 branch.
-      Please see the <filename>CHANGES</filename> file for a further
-      list of bug fixes and other changes.
+      This document summarizes changes since BIND 9.10.6.
+    </para>
+    <para>
+      BIND 9.10.6-P1 addresses the security issue described in
+      CVE-2017-3145.
     </para>
   </section>
 
@@ -76,6 +77,16 @@
 
   <section xml:id="relnotes_security"><info><title>Security Fixes</title></info>
     <itemizedlist>
+      <listitem>
+       <para>
+         Addresses could be referenced after being freed during resolver
+         processing, causing an assertion failure. The chances of this
+         happening were remote, but the introduction of a delay in
+         resolution increased them. (The delay will be addressed in
+         an upcoming maintenance release.) This bug is disclosed in
+         CVE-2017-3145. [RT #46839]
+       </para>
+      </listitem>
       <listitem>
        <para>
          An error in TSIG handling could permit unauthorized zone

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 6963a47572b82cc23c8d4bad01e7092c1aa55d69..6bdaa9df814617b36f38c908e66783dc283a2bb9 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -846,7 +846,7 @@ fctx_stoptimer(fetchctx_t *fctx) {
         * cannot fail in that case.
         */
        result = isc_timer_reset(fctx->timer, isc_timertype_inactive,
-                                 NULL, NULL, ISC_TRUE);
+                                NULL, NULL, ISC_TRUE);
        if (result != ISC_R_SUCCESS) {
                UNEXPECTED_ERROR(__FILE__, __LINE__,
                                 "isc_timer_reset(): %s",
@@ -854,7 +854,6 @@ fctx_stoptimer(fetchctx_t *fctx) {
        }
 }
 
-
 static inline isc_result_t
 fctx_startidletimer(fetchctx_t *fctx, isc_interval_t *interval) {
        /*
@@ -1134,7 +1133,8 @@ fctx_cleanupfinds(fetchctx_t *fctx) {
 
        for (find = ISC_LIST_HEAD(fctx->finds);
             find != NULL;
-            find = next_find) {
+            find = next_find)
+       {
                next_find = ISC_LIST_NEXT(find, publink);
                ISC_LIST_UNLINK(fctx->finds, find, publink);
                dns_adb_destroyfind(&find);
@@ -1150,7 +1150,8 @@ fctx_cleanupaltfinds(fetchctx_t *fctx) {
 
        for (find = ISC_LIST_HEAD(fctx->altfinds);
             find != NULL;
-            find = next_find) {
+            find = next_find)
+       {
                next_find = ISC_LIST_NEXT(find, publink);
                ISC_LIST_UNLINK(fctx->altfinds, find, publink);
                dns_adb_destroyfind(&find);
@@ -1166,7 +1167,8 @@ fctx_cleanupforwaddrs(fetchctx_t *fctx) {
 
        for (addr = ISC_LIST_HEAD(fctx->forwaddrs);
             addr != NULL;
-            addr = next_addr) {
+            addr = next_addr)
+       {
                next_addr = ISC_LIST_NEXT(addr, publink);
                ISC_LIST_UNLINK(fctx->forwaddrs, addr, publink);
                dns_adb_freeaddrinfo(fctx->adb, &addr);
@@ -1181,7 +1183,8 @@ fctx_cleanupaltaddrs(fetchctx_t *fctx) {
 
        for (addr = ISC_LIST_HEAD(fctx->altaddrs);
             addr != NULL;
-            addr = next_addr) {
+            addr = next_addr)
+       {
                next_addr = ISC_LIST_NEXT(addr, publink);
                ISC_LIST_UNLINK(fctx->altaddrs, addr, publink);
                dns_adb_freeaddrinfo(fctx->adb, &addr);
@@ -1189,16 +1192,20 @@ fctx_cleanupaltaddrs(fetchctx_t *fctx) {
 }
 
 static inline void
-fctx_stopeverything(fetchctx_t *fctx, isc_boolean_t no_response,
-                   isc_boolean_t age_untried)
+fctx_stopqueries(fetchctx_t *fctx, isc_boolean_t no_response,
+                isc_boolean_t age_untried)
 {
-       FCTXTRACE("stopeverything");
+       FCTXTRACE("stopqueries");
        fctx_cancelqueries(fctx, no_response, age_untried);
+       fctx_stoptimer(fctx);
+}
+
+static inline void
+fctx_cleanupall(fetchctx_t *fctx) {
        fctx_cleanupfinds(fctx);
        fctx_cleanupaltfinds(fctx);
        fctx_cleanupforwaddrs(fctx);
        fctx_cleanupaltaddrs(fctx);
-       fctx_stoptimer(fctx);
 }
 
 #ifdef ENABLE_FETCHLIMIT
@@ -1451,7 +1458,8 @@ fctx_done(fetchctx_t *fctx, isc_result_t result, int line) {
                age_untried = ISC_TRUE;
 
        fctx->reason = NULL;
-       fctx_stopeverything(fctx, no_response, age_untried);
+
+       fctx_stopqueries(fctx, no_response, age_untried);
 
        LOCK(&res->buckets[fctx->bucketnum].lock);
 
@@ -3959,11 +3967,12 @@ fctx_doshutdown(isc_task_t *task, isc_event_t *event) {
                dns_resolver_cancelfetch(fctx->nsfetch);
 
        /*
-        * Shut down anything that is still running on behalf of this
-        * fetch.  To avoid deadlock with the ADB, we must do this
-        * before we lock the bucket lock.
+        * Shut down anything still running on behalf of this
+        * fetch, and clean up finds and addresses.  To avoid deadlock
+        * with the ADB, we must do this before we lock the bucket lock.
         */
-       fctx_stopeverything(fctx, ISC_FALSE, ISC_FALSE);
+       fctx_stopqueries(fctx, ISC_FALSE, ISC_FALSE);
+       fctx_cleanupall(fctx);
 
        LOCK(&res->buckets[bucketnum].lock);