diff --git a/SPECS/coredns/CVE-2026-62299.patch b/SPECS/coredns/CVE-2026-62299.patch new file mode 100644 index 00000000000..3e282d32a42 --- /dev/null +++ b/SPECS/coredns/CVE-2026-62299.patch @@ -0,0 +1,174 @@ +From 7defaccd69bdd78308a6694ffe4ded3282c21178 Mon Sep 17 00:00:00 2001 +From: Yong Tang +Date: Tue, 23 Jun 2026 16:02:35 -0700 +Subject: [PATCH] plugin/rewrite: Fix nil-pointer panic in EDNS0 response + reversion with no OPT record (#8190) + +* plugin/rewrite: Fix nil-pointer panic in EDNS0 response reversion with no OPT record + +This PR fix a nil-pointer panic in EDNS0 response reversion when downstream responses do not contain an OPT record, + +Signed-off-by: Yong Tang + +* Fix + +Signed-off-by: Yong Tang + +--------- + +Signed-off-by: Yong Tang +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/coredns/coredns/commit/fc447d0658b093edc8cd29a6b171216a44a644c2.patch +--- + plugin/rewrite/edns0.go | 6 ++ + plugin/rewrite/reverter_test.go | 113 ++++++++++++++++++++++++++++++++ + 2 files changed, 119 insertions(+) + +diff --git a/plugin/rewrite/edns0.go b/plugin/rewrite/edns0.go +index 44e4579..74128b8 100644 +--- a/plugin/rewrite/edns0.go ++++ b/plugin/rewrite/edns0.go +@@ -47,6 +47,9 @@ type edns0SetResponseRule struct { + + func (r *edns0SetResponseRule) RewriteResponse(res *dns.Msg, _ dns.RR) { + ednsOpt := res.IsEdns0() ++ if ednsOpt == nil { ++ return ++ } + for idx, opt := range ednsOpt.Option { + if opt.Option() == r.code { + ednsOpt.Option = append(ednsOpt.Option[:idx], ednsOpt.Option[idx+1:]...) +@@ -62,6 +65,9 @@ type edns0ReplaceResponseRule[T dns.EDNS0] struct { + + func (r *edns0ReplaceResponseRule[T]) RewriteResponse(res *dns.Msg, _ dns.RR) { + ednsOpt := res.IsEdns0() ++ if ednsOpt == nil { ++ return ++ } + for idx, opt := range ednsOpt.Option { + if opt.Option() == r.code { + ednsOpt.Option[idx] = r.source +diff --git a/plugin/rewrite/reverter_test.go b/plugin/rewrite/reverter_test.go +index b4a7824..370cee5 100644 +--- a/plugin/rewrite/reverter_test.go ++++ b/plugin/rewrite/reverter_test.go +@@ -193,3 +193,116 @@ func doValueReverterTests(name string, rules []Rule, t *testing.T) { + } + } + } ++ ++var edns0NoOPTRevertTests = []struct { ++ name string ++ args []string ++ req func() *dns.Msg ++}{ ++ { ++ name: "local_set_revert", ++ args: []string{ ++ "edns0", "local", "set", ++ "0xffee", "0xabcdef", ++ "revert", ++ }, ++ req: func() *dns.Msg { ++ m := new(dns.Msg) ++ m.SetQuestion("example.org.", dns.TypeA) ++ m.Question[0].Qclass = dns.ClassINET ++ return m ++ }, ++ }, ++ { ++ name: "local_replace_revert", ++ args: []string{ ++ "edns0", "local", "replace", ++ "0xffee", "0x222222", ++ "revert", ++ }, ++ req: func() *dns.Msg { ++ m := new(dns.Msg) ++ m.SetQuestion("example.org.", dns.TypeA) ++ m.Question[0].Qclass = dns.ClassINET ++ ++ opt := new(dns.OPT) ++ opt.Hdr.Name = "." ++ opt.Hdr.Rrtype = dns.TypeOPT ++ ++ opt.Option = append(opt.Option, ++ &dns.EDNS0_LOCAL{ ++ Code: 0xffee, ++ Data: []byte{0x11, 0x11, 0x11}, ++ }, ++ ) ++ ++ m.Extra = append(m.Extra, opt) ++ ++ return m ++ }, ++ }, ++} ++ ++func TestEDNS0ResponseReverterNoOPT(t *testing.T) { ++ ctx := context.TODO() ++ ++ for _, tc := range edns0NoOPTRevertTests { ++ t.Run(tc.name, func(t *testing.T) { ++ r, err := newRule(tc.args...) ++ if err != nil { ++ t.Fatalf("cannot parse rule: %s", err) ++ } ++ ++ rw := Rewrite{ ++ Next: plugin.HandlerFunc(noOPTMsgPrinter), ++ Rules: []Rule{r}, ++ RevertPolicy: NewRevertPolicy(false, false), ++ } ++ ++ rec := dnstest.NewRecorder(&test.ResponseWriter{}) ++ ++ rw.ServeDNS(ctx, rec, tc.req()) ++ ++ resp := rec.Msg ++ if resp == nil { ++ t.Fatal("expected response") ++ } ++ ++ if resp.Rcode != dns.RcodeSuccess { ++ t.Fatalf( ++ "expected rcode %d got %d", ++ dns.RcodeSuccess, ++ resp.Rcode, ++ ) ++ } ++ ++ if len(resp.Answer) != 1 { ++ t.Fatalf( ++ "expected 1 answer got %d", ++ len(resp.Answer), ++ ) ++ } ++ ++ if resp.IsEdns0() != nil { ++ t.Fatalf("expected response without OPT record") ++ } ++ }) ++ } ++} ++ ++func noOPTMsgPrinter(_ context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) { ++ m := new(dns.Msg) ++ m.SetReply(r) ++ ++ m.Answer = []dns.RR{ ++ test.A("example.org. 60 IN A 127.0.0.1"), ++ } ++ ++ // Deliberately do NOT add an OPT RR. ++ ++ if err := w.WriteMsg(m); err != nil { ++ return dns.RcodeServerFailure, err ++ } ++ ++ return dns.RcodeSuccess, nil ++} +-- +2.45.4 + diff --git a/SPECS/coredns/coredns.spec b/SPECS/coredns/coredns.spec index b211c416bd9..e8957a1a47e 100644 --- a/SPECS/coredns/coredns.spec +++ b/SPECS/coredns/coredns.spec @@ -6,7 +6,7 @@ Summary: Fast and flexible DNS server Name: coredns Version: 1.11.4 -Release: 17%{?dist} +Release: 18%{?dist} License: Apache License 2.0 Vendor: Microsoft Corporation Distribution: Azure Linux @@ -53,6 +53,7 @@ Patch14: CVE-2026-32936.patch Patch15: CVE-2026-33489.patch Patch16: CVE-2026-33190.patch Patch17: CVE-2026-39821.patch +Patch18: CVE-2026-62299.patch BuildRequires: golang < 1.25 @@ -94,6 +95,9 @@ go install github.com/fatih/faillint@latest && \ %{_bindir}/%{name} %changelog +* Fri Jul 17 2026 Azure Linux Security Servicing Account - 1.11.4-18 +- Patch for CVE-2026-62299 + * Wed May 27 2026 Azure Linux Security Servicing Account - 1.11.4-17 - Patch for CVE-2026-39821