- Fix CVE-2026-44608, Use after free and crash in RPZ code. Thanks

  to Qifan Zhang, Palo Alto Networks, for the report.

diff --git a/doc/Changelog b/doc/Changelog
index a9fd4dc95fa56b6c30b26481026aa560ccd8e22d..02148aaa1b36aa36d62a4ac283be99816bc729d8 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -25,6 +25,8 @@
        - Fix CVE-2026-44390, Unbounded name compression in certain cases
          causes degradation of service. Thanks to Qifan Zhang, Palo Alto
          Networks, for the report.
+       - Fix CVE-2026-44608, Use after free and crash in RPZ code. Thanks
+         to Qifan Zhang, Palo Alto Networks, for the report.
 
 23 April 2026: Wouter
        - Merge #1441: Fix buffer overrun in

diff --git a/services/rpz.c b/services/rpz.c
index d83acbfb08e0cc957f46f9a53f289084b260bf35..5121e46b54578ddee207ddfaf2382259f069e1d1 100644 (file)
--- a/services/rpz.c
+++ b/services/rpz.c
@@ -2469,6 +2469,7 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
 {
        struct auth_zones* az;
        struct auth_zone* a;
+       struct dns_msg* ret = NULL;
        struct clientip_synthesized_rr* raddr = NULL;
        struct rpz* r = NULL;
        struct local_zone* z = NULL;
@@ -2512,13 +2513,11 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
                z = rpz_delegation_point_zone_lookup(is->dp, r->nsdname_zones,
                                                     is->qchase.qclass, &match);
                if(z != NULL) {
-                       lock_rw_unlock(&a->lock);
                        break;
                }
 
                raddr = rpz_delegation_point_ipbased_trigger_lookup(r, is);
                if(raddr != NULL) {
-                       lock_rw_unlock(&a->lock);
                        break;
                }
                lock_rw_unlock(&a->lock);
@@ -2533,9 +2532,12 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
                if(z) {
                        lock_rw_unlock(&z->lock);
                }
-               return rpz_apply_nsip_trigger(ms, &is->qchase, r, raddr, a);
+               ret = rpz_apply_nsip_trigger(ms, &is->qchase, r, raddr, a);
+       } else {
+               ret = rpz_apply_nsdname_trigger(ms, &is->qchase, r, z, &match, a);
        }
-       return rpz_apply_nsdname_trigger(ms, &is->qchase, r, z, &match, a);
+       lock_rw_unlock(&a->lock);
+       return ret;
 }
 
 struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms,