Skip to content

[AutoPR- Security] Patch coredns for CVE-2026-62299 [MEDIUM] #18047

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kgodara912 merged 1 commit into from
Jul 20, 2026
+179 −1
Merged

[AutoPR- Security] Patch coredns for CVE-2026-62299 [MEDIUM] #18047

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
174 changes: 174 additions & 0 deletions SPECS/coredns/CVE-2026-62299.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,174 @@
From 7defaccd69bdd78308a6694ffe4ded3282c21178 Mon Sep 17 00:00:00 2001
From: Yong Tang <yong.tang.github@outlook.com>
Date: Tue, 23 Jun 2026 16:02:35 -0700
Subject: [PATCH] plugin/rewrite: Fix nil-pointer panic in EDNS0 response
reversion with no OPT record (#8190)

* plugin/rewrite: Fix nil-pointer panic in EDNS0 response reversion with no OPT record

This PR fix a nil-pointer panic in EDNS0 response reversion when downstream responses do not contain an OPT record,

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

* Fix

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

---------

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Upstream-reference: https://github.com/coredns/coredns/commit/fc447d0658b093edc8cd29a6b171216a44a644c2.patch
---
plugin/rewrite/edns0.go | 6 ++
plugin/rewrite/reverter_test.go | 113 ++++++++++++++++++++++++++++++++
2 files changed, 119 insertions(+)

diff --git a/plugin/rewrite/edns0.go b/plugin/rewrite/edns0.go
index 44e4579..74128b8 100644
--- a/plugin/rewrite/edns0.go
+++ b/plugin/rewrite/edns0.go
@@ -47,6 +47,9 @@ type edns0SetResponseRule struct {

func (r *edns0SetResponseRule) RewriteResponse(res *dns.Msg, _ dns.RR) {
ednsOpt := res.IsEdns0()
+ if ednsOpt == nil {
+ return
+ }
for idx, opt := range ednsOpt.Option {
if opt.Option() == r.code {
ednsOpt.Option = append(ednsOpt.Option[:idx], ednsOpt.Option[idx+1:]...)
@@ -62,6 +65,9 @@ type edns0ReplaceResponseRule[T dns.EDNS0] struct {

func (r *edns0ReplaceResponseRule[T]) RewriteResponse(res *dns.Msg, _ dns.RR) {
ednsOpt := res.IsEdns0()
+ if ednsOpt == nil {
+ return
+ }
for idx, opt := range ednsOpt.Option {
if opt.Option() == r.code {
ednsOpt.Option[idx] = r.source
diff --git a/plugin/rewrite/reverter_test.go b/plugin/rewrite/reverter_test.go
index b4a7824..370cee5 100644
--- a/plugin/rewrite/reverter_test.go
+++ b/plugin/rewrite/reverter_test.go
@@ -193,3 +193,116 @@ func doValueReverterTests(name string, rules []Rule, t *testing.T) {
}
}
}
+
+var edns0NoOPTRevertTests = []struct {
+ name string
+ args []string
+ req func() *dns.Msg
+}{
+ {
+ name: "local_set_revert",
+ args: []string{
+ "edns0", "local", "set",
+ "0xffee", "0xabcdef",
+ "revert",
+ },
+ req: func() *dns.Msg {
+ m := new(dns.Msg)
+ m.SetQuestion("example.org.", dns.TypeA)
+ m.Question[0].Qclass = dns.ClassINET
+ return m
+ },
+ },
+ {
+ name: "local_replace_revert",
+ args: []string{
+ "edns0", "local", "replace",
+ "0xffee", "0x222222",
+ "revert",
+ },
+ req: func() *dns.Msg {
+ m := new(dns.Msg)
+ m.SetQuestion("example.org.", dns.TypeA)
+ m.Question[0].Qclass = dns.ClassINET
+
+ opt := new(dns.OPT)
+ opt.Hdr.Name = "."
+ opt.Hdr.Rrtype = dns.TypeOPT
+
+ opt.Option = append(opt.Option,
+ &dns.EDNS0_LOCAL{
+ Code: 0xffee,
+ Data: []byte{0x11, 0x11, 0x11},
+ },
+ )
+
+ m.Extra = append(m.Extra, opt)
+
+ return m
+ },
+ },
+}
+
+func TestEDNS0ResponseReverterNoOPT(t *testing.T) {
+ ctx := context.TODO()
+
+ for _, tc := range edns0NoOPTRevertTests {
+ t.Run(tc.name, func(t *testing.T) {
+ r, err := newRule(tc.args...)
+ if err != nil {
+ t.Fatalf("cannot parse rule: %s", err)
+ }
+
+ rw := Rewrite{
+ Next: plugin.HandlerFunc(noOPTMsgPrinter),
+ Rules: []Rule{r},
+ RevertPolicy: NewRevertPolicy(false, false),
+ }
+
+ rec := dnstest.NewRecorder(&test.ResponseWriter{})
+
+ rw.ServeDNS(ctx, rec, tc.req())
+
+ resp := rec.Msg
+ if resp == nil {
+ t.Fatal("expected response")
+ }
+
+ if resp.Rcode != dns.RcodeSuccess {
+ t.Fatalf(
+ "expected rcode %d got %d",
+ dns.RcodeSuccess,
+ resp.Rcode,
+ )
+ }
+
+ if len(resp.Answer) != 1 {
+ t.Fatalf(
+ "expected 1 answer got %d",
+ len(resp.Answer),
+ )
+ }
+
+ if resp.IsEdns0() != nil {
+ t.Fatalf("expected response without OPT record")
+ }
+ })
+ }
+}
+
+func noOPTMsgPrinter(_ context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error) {
+ m := new(dns.Msg)
+ m.SetReply(r)
+
+ m.Answer = []dns.RR{
+ test.A("example.org. 60 IN A 127.0.0.1"),
+ }
+
+ // Deliberately do NOT add an OPT RR.
+
+ if err := w.WriteMsg(m); err != nil {
+ return dns.RcodeServerFailure, err
+ }
+
+ return dns.RcodeSuccess, nil
+}
--
2.45.4

6 changes: 5 additions & 1 deletion SPECS/coredns/coredns.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
Summary: Fast and flexible DNS server
Name: coredns
Version: 1.11.4
Release: 17%{?dist}
Release: 18%{?dist}
License: Apache License 2.0
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -53,6 +53,7 @@ Patch14: CVE-2026-32936.patch
Patch15: CVE-2026-33489.patch
Patch16: CVE-2026-33190.patch
Patch17: CVE-2026-39821.patch
Patch18: CVE-2026-62299.patch

BuildRequires: golang < 1.25

Expand Down Expand Up @@ -94,6 +95,9 @@ go install github.com/fatih/faillint@latest && \
%{_bindir}/%{name}

%changelog
* Fri Jul 17 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.11.4-18
- Patch for CVE-2026-62299

* Wed May 27 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.11.4-17
- Patch for CVE-2026-39821

Expand Down
Loading