Bug 1963990

Summary:	bind: missing validation while handling TKEY queries leads to out-of-bound read
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aegorenk, anon.amish, dns-sig, mruprich, msehnout, pemensik, vonsch, zdohnal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	bind 9.11.31, bind 9.16.15	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in bind. Missing validation in the der_match_tag_and_length function leads to an out-of-bound read allowing an unauthenticated remote attacker to leak data from the bind server. The highest threat from this vulnerability is to data confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-28 12:27:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1963991, 1963993
Bug Blocks:	1974318

Description Michael Kaplan 2021-05-24 14:22:39 UTC

The specific flaw exists within the handling of TKEY queries. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the "bind" user.

Comment 1 Michael Kaplan 2021-05-24 14:22:56 UTC

Created bind tracking bugs for this issue:

Affects: fedora-all [bug 1963991]

Comment 3 Riccardo Schirone 2021-06-21 12:38:35 UTC

The issue was in the internal implementation of SPNEGO in spnego.c. Function der_match_tag_and_length() reads a length from the user-provided data without validating it. The length is then used in other functions, potentially allowing to read beyond the bounds of a buffer.

This problem was fixed upstream by completely removing the internal SPNEGO implementation.

Comment 5 Riccardo Schirone 2021-06-21 12:43:58 UTC

It seems SPNEGO internal implementation was first introduced with:
https://github.com/isc-projects/bind9/commit/289ae548d52bc8f982d9823af64cafda7bd92232

It was then removed in:
https://github.com/isc-projects/bind9/commit/978c7b2e89aa37a7ddfe2f6b6ba12ce73dd04528