Bug 2558421

Summary:	CVE-2026-94300 dhcp: bind: Arbitrary code execution via GSS-TSIG UDP message replay [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Marco Benatto <mbenatto>
Component:	dhcp	Assignee:	Martin Osvald 🛹 <mosvald>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	fhrdina, jorton, mosvald, pavel, pemensik
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["c0cca438-0b7a-4fa2-81d9-23704f761425"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-22 07:29:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2556407

Description Marco Benatto 2026-10-21 17:58:57 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution.

Comment 1 Martin Osvald 🛹 2026-10-22 07:29:14 UTC

ISC DHCP is not affected.

CVE-2026-94300 is a memory corruption flaw in the BIND name server (named) in its handling of replayed GSS-TSIG signed UDP messages. It requires a server that has GSS-TSIG enabled (for example tkey-gssapi-keytab or Kerberos-based update-policy).

ISC DHCP bundles BIND 9.11.14 libraries (libisc, libdns, libisccfg) and builds them with --without-gssapi (bind/Makefile.in), so the GSS-TSIG code in libdns (gssapi_link.c, gssapictx.c, and the DST_ALG_GSSAPI paths in dst_api.c) is not compiled in. DHCP's own code (client, common, server, relay, omapip, dhcpctl) does not use GSS-TSIG or TKEY. OMAPI authentication uses plain HMAC keys, and DDNS updates use only TSIG with HMAC keys. DHCP also does not run a name server that could accept such messages.

The --with-ldap-gssapi option used in the dhcp build is for Kerberos authentication to OpenLDAP and is unrelated to BIND's GSS-TSIG.