DiG crashes on +nssearch with +tcp in bind9 9.18

[Joshua Rogers]

[Impact]

When using dig with the +nssearch and +tcp options, the application will crash with a core dump.

The fix should be backported to Kinetic and Jammy to allow users to get all results of an nssearch through tcp on a domain.

The bug will be fixed by the minor release update described in (LP: #2003586) through upstream correcting IPv6 functionality.

[Test Plan]

# lxc launch images:ubuntu/{kinetic, jammy} test-bind9
# lxc exec test-bind9
# apt update && apt dist-upgrade -y
# apt install dnsutils -y
# dig google.com +nssearch +tcp
- Before the update this leads to a crash ending in "Aborted (core dumped)" without showing all addresses while after it will show that there was a communication error with addresses it did not get a response from and finish running through all addresses

[Where problems could occur]

Problems could occour in multiple areas outside of this fix because it is being added in a minor release update. Issues directly related to this fix would arise in the functionality of dig +nssearch +tcp, likely related to the handling of domains containing IPv6 addresses.

[Original Description]

Precursor: 'DiG' is provided in the package "bind9", and the version in DiG is the same version of bind9.
Whilst running 'DiG', with +ssearch, AND +tcp, on the DiG version that is available in the repo's("DiG 9.8.1-P1"), the program segfaults with a core dump.

Example:

13:13:14 (toil@laptop) ~ $ dig -v
DiG 9.8.1-P1
13:13:37 (toil@laptop) ~ $ dig +time=3 +nssearch +tcp internot.info
socket.c:2535: REQUIRE(socketp != ((void *)0) && *socketp == ((void *)0)) failed, back trace
#0 0x4f877b in ??
#1 0x4f86c4 in ??
#2 0x52b062 in ??
#3 0xfd03ef in ??
#4 0xfd07c3 in ??
#5 0x51b9ac in ??
#6 0x7cdd4c in ??
#7 0x1ffbae in ??
Aborted (core dumped)

It's strange that it gives a back trace, but that's irrelevant anyways.

Although I'm unsure of which version exactly it's fixed in, but it doesn't work in "DiG 9.10.0a1".
It also seems to be patched in "DiG 9.8.4-P2", but that probably isn't useful (due to the P2)..

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: bind9-host 1:9.8.1.dfsg.P1-4ubuntu0.7
ProcVersionSignature: Ubuntu 3.2.0-56.86-generic 3.2.51
Uname: Linux 3.2.0-56-generic i686
NonfreeKernelModules: wl
ApportVersion: 2.0.1-0ubuntu17.6
Architecture: i386
Date: Thu Dec 5 13:11:08 2013
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 10.04 LTS "Lucid Lynx" - Release i386 (20100429)
MarkForUpload: True
ProcEnviron:
 TERM=xterm
 PATH=(custom, no user)
 LANG=en_AU.UTF-8
 SHELL=/bin/bash
SourcePackage: bind9
UpgradeStatus: Upgraded to precise on 2013-08-26 (100 days ago)

[Joshua Rogers (megamansec)]

Erm, it looks like /usr/bin/dig is actually provided by `dnsutils', not bind9. Strange.

[Joshua Rogers (megamansec)]

Just an update on this: It is patched in Ubuntu 14.04.1.

I have identified another bug in DiG which is yet to be patched in any versions of bind(I only just reported it now), which affects those that use ipv6.

megamansec@megamansec:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 14.04.1 LTS
Release: 14.04
Codename: trusty

megamansec@megamansec:~$ dig +time=3 +nssearch +tcp internot.info
;; Connection to 2400:cb00:2049:1::adf5:3b95#53(2400:cb00:2049:1::adf5:3b95) for internot.info failed: network unreachable.
Segmentation fault

megamansec@megamansec:~$ dig +time=3 +nssearch +tcp google.com
SOA ns1.google.com. dns-admin.google.com. 2014101500 7200 1800 1209600 300 from server 216.239.38.10 in 231 ms.
SOA ns1.google.com. dns-admin.google.com. 2014101500 7200 1800 1209600 300 from server 216.239.32.10 in 238 ms.
SOA ns1.google.com. dns-admin.google.com. 2014101500 7200 1800 1209600 300 from server 216.239.36.10 in 239 ms.
SOA ns1.google.com. dns-admin.google.com. 2014101500 7200 1800 1209600 300 from server 216.239.34.10 in 283 ms.

So, perhaps before pushing anything, wait for ISC to fix the most recent bug I identified.

[Sergio Durigan Junior (sergiodj)]

I'm repurposing this bug because dig +nssearch is crashing again in bind9 9.18:

# dig +nssearch isc.org.
SOA ns-int.isc.org. hostmaster.isc.org. 2022031252 7200 3600 24796800 3600 from server 149.20.1.73 in 59 ms.
SOA ns-int.isc.org. hostmaster.isc.org. 2022031252 7200 3600 24796800 3600 from server 199.6.1.52 in 91 ms.
SOA ns-int.isc.org. hostmaster.isc.org. 2022031252 7200 3600 24796800 3600 from server 51.75.79.143 in 159 ms.
SOA ns-int.isc.org. hostmaster.isc.org. 2022031252 7200 3600 24796800 3600 from server 199.254.63.254 in 195 ms.
dighost.c:1651: REQUIRE(targetp != ((void *)0) && *targetp == ((void *)0)) failed, back trace
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(+0x328f3)[0x7fbb937678f3]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(isc_assertion_failed+0x10)[0x7fbb93766de0]
dig(+0x16f40)[0x55929fb20f40]
dig(+0xee4e)[0x55929fb18e4e]
dig(+0x1002f)[0x55929fb1a02f]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(isc__nm_async_readcb+0xb1)[0x7fbb93755f91]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(isc__nm_readcb+0x9b)[0x7fbb937560cb]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(+0x22645)[0x7fbb93757645]
/lib/x86_64-linux-gnu/libuv.so.1(uv_run+0xce)[0x7fbb932696de]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(+0x261ce)[0x7fbb9375b1ce]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(isc__trampoline_run+0x1a)[0x7fbb9378e1ca]
/lib/x86_64-linux-gnu/libc.so.6(+0x94b43)[0x7fbb93321b43]
/lib/x86_64-linux-gnu/libc.so.6(+0x126a00)[0x7fbb933b3a00]
Aborted (core dumped)

The example from the original bug report also crashes for me, with in a different place:

# dig +time=3 +nssearch +tcp internot.info
dighost.c:1683: INSIST(query->readhandle == ((void *)0)) failed, back trace
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(+0x328f3)[0x7f60f32508f3]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(isc_assertion_failed+0x10)[0x7f60f324fde0]
dig(+0x1686e)[0x560ec808b86e]
dig(+0x169b9)[0x560ec808b9b9]
dig(+0xcb87)[0x560ec8081b87]
dig(+0x1152a)[0x560ec808652a]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(isc__nm_async_readcb+0xb1)[0x7f60f323ef91]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(isc__nm_readcb+0x9b)[0x7f60f323f0cb]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(isc__nm_tcpdns_processbuffer+0x11b)[0x7f60f32460db]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(isc__nm_process_sock_buffer+0x25)[0x7f60f323c0f5]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(isc__nm_tcpdns_read_cb+0xbc)[0x7f60f32499dc]
/lib/x86_64-linux-gnu/libuv.so.1(+0x1fe88)[0x7f60f2d63e88]
/lib/x86_64-linux-gnu/libuv.so.1(+0x204d8)[0x7f60f2d644d8]
/lib/x86_64-linux-gnu/libuv.so.1(+0x2511e)[0x7f60f2d6911e]
/lib/x86_64-linux-gnu/libuv.so.1(uv_run+0x678)[0x7f60f2d52c88]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(+0x261ce)[0x7f60f32441ce]
/lib/x86_64-linux-gnu/libisc-9.18.0-2ubuntu3-Ubuntu.so(isc__trampoline_run+0x1a)[0x7f60f32771ca]
/lib/x86_64-linux-gnu/libc.so.6(+0x94b43)[0x7f60f2e0ab43]
/lib/x86_64-linux-gnu/libc.so.6(+0x126a00)[0x7f60f2e9ca00]

There are a few upstream bugs opened about this; I will link them here.

[Sergio Durigan Junior (sergiodj)]

I tested on Focal and Bionic; both are OK. This is a Jammy issue.

[Sergio Durigan Junior (sergiodj)]

Upstream bugs:

https://gitlab.isc.org/isc-projects/bind9/-/issues/3144

https://gitlab.isc.org/isc-projects/bind9/-/issues/3207 (somewhat related; the crash happens at the same place)

[Lucas Kanashiro (lucaskanashiro)]

It seems that the upstream issues were fixed. We might want to revisit them and see what we can do to apply the fix in Ubuntu.

[Robin Sheat (eythian)]

Reproducible by:

$ dig +trace -t ANY ubuntu.com

but this possibly deserves its own bug, rather than picking up a 9 year old one.

[Steve Langasek (vorlon)]

Hello Joshua, or anyone else affected,

Accepted bind9 into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/bind9/1:9.18.12-0ubuntu0.22.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Steve Langasek (vorlon)]

Hello Joshua, or anyone else affected,

Accepted bind9 into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/bind9/1:9.18.12-0ubuntu0.22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted bind9 (1:9.18.12-0ubuntu0.22.10.1) for kinetic have finished running.
The following regressions have been reported in tests triggered by the package:

testssl.sh/3.0.7+dfsg-1 (arm64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/kinetic/update_excuses.html#bind9

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Lena Voytek (lvoytek)]

Verified for Jammy and Kinetic:

# lxc launch images:ubuntu/jammy test-bind9
# lxc exec test-bind9

# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
# Enable Ubuntu proposed archive
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF

# apt update && apt dist-upgrade -y
# apt install dnsutils -y
# dig google.com +nssearch +tcp

;; Connection to 2001:4860:4802:36::a#53(2001:4860:4802:36::a) for google.com failed: timed out.
SOA ns1.google.com. dns-admin.google.com. 518223234 900 900 1800 60 from server 216.239.38.10 in 87 ms.
SOA ns1.google.com. dns-admin.google.com. 518521970 900 900 1800 60 from server 216.239.36.10 in 47 ms.
;; Connection to 2001:4860:4802:34::a#53(2001:4860:4802:34::a) for google.com failed: timed out.
;; Connection to 2001:4860:4802:32::a#53(2001:4860:4802:32::a) for google.com failed: timed out.
SOA ns1.google.com. dns-admin.google.com. 518521970 900 900 1800 60 from server 216.239.32.10 in 31 ms.
SOA ns1.google.com. dns-admin.google.com. 518521970 900 900 1800 60 from server 216.239.34.10 in 35 ms.
;; Connection to 2001:4860:4802:38::a#53(2001:4860:4802:38::a) for google.com failed: timed out.

# lxc launch images:ubuntu/kinetic test-bind9
# lxc exec test-bind9

# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
# Enable Ubuntu proposed archive
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF

# apt update && apt dist-upgrade -y
# apt install dnsutils -y
# dig google.com +nssearch +tcp

;; Connection to 2001:4860:4802:34::a#53(2001:4860:4802:34::a) for google.com failed: timed out.
SOA ns1.google.com. dns-admin.google.com. 518521970 900 900 1800 60 from server 216.239.36.10 in 51 ms.
SOA ns1.google.com. dns-admin.google.com. 518521970 900 900 1800 60 from server 216.239.34.10 in 27 ms.
;; Connection to 2001:4860:4802:38::a#53(2001:4860:4802:38::a) for google.com failed: timed out.
;; Connection to 2001:4860:4802:32::a#53(2001:4860:4802:32::a) for google.com failed: timed out.
;; Connection to 2001:4860:4802:36::a#53(2001:4860:4802:36::a) for google.com failed: timed out.
SOA ns1.google.com. dns-admin.google.com. 518521970 900 900 1800 60 from server 216.239.32.10 in 31 ms.
SOA ns1.google.com. dns-admin.google.com. 518223234 900 900 1800 60 from server 216.239.38.10 in 83 ms.

[Launchpad Janitor (janitor)]

This bug was fixed in the package bind9 - 1:9.18.12-0ubuntu0.22.04.1

---------------
bind9 (1:9.18.12-0ubuntu0.22.04.1) jammy; urgency=medium

  * New upstream releases 9.18.2 - 9.18.12 (LP: #2003586)
    - Updates:
      + update-quota option
      + named -V shows supported cryptographic algorithms
      + Catalog Zones schema version 2 support in named
      + DNS error support Stale Answer and Stale NXDOMAIN Answer
      + Remote TLS certificate verification support
      + reusereport option
    - Bug Fixes Include:
      + Fix crash when using dig with +nssearch and +tcp (LP: #1258003)
      + Fix incomplete results using dig with +nssearch (LP: #1970252)
      + Fix loading of preinstalled plugins (LP: #2006972)
      + CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080,
        CVE-2022-38178, CVE-2022-3094, CVE-2022-3736, CVE-2022-3924,
        CVE-2022-1183
      + Fix thread safety in dns_dispatch
      + Fix ADB quota management in resolver
      + Fix Prohibited DNS error on allow-recursion
      + Fix crash when restarting server with active statschannel connection
      + Fix use after free for catalog zone processing
      + Fix leak of dns_keyfileio_t objects
      + Fix nslookup failure to use port option when record type ANY is used
      + Fix crash on dnssec-policy zone with NSEC3 and inline-signing turned on
      + Fix inheritance when setting remote server port
      + Fix assertion error when accessing statistics channel
      + Fix rndc dumpdb -expired for stuck cache
      + Fix check for other name servers after receiving FORMERR
      + Fix deletion of CDS after zone sign
      + Fix dighost query context management
      + Fix dig hanging due to IPv4 mapped IPv6 address
      + See https://bind9.readthedocs.io/en/v9_18_12/notes.html#notes-for-bind-9-18-12
        for additional bug fixes and information
  * Improve dep-8 test suite (LP: #2003584):
    - d/t/zonetest: Add dep8 test for checking the domain zone creation process
    - d/t/control: Add new test outline
  * d/bind9-doc.docs: Stop installing removed file doc/misc/options.active
  * Remove patches for bugs LP #1964400 and LP #1964686 fixed upstream:
    - lp1964400-lp1964686-Fix-an-issue-in-dig-when-retrying-with-the-next-serv
    - lp1964400-lp1964686-When-resending-a-UDP-request-insert-the-query-to-the
    - lp1964400-lp1964686-Add-digdelv-system-test-to-check-timed-out-result-fo
    - lp1964400-lp1964686-After-dig-request-errors-try-to-use-other-servers-wh
    - lp1964400-lp1964686-Add-digdelv-system-test-to-check-that-dig-tries-othe
    - lp1964400-lp1964686-Fix-dig-error-when-trying-the-next-server-after-a-TC
    - lp1964400-lp1964686-Add-various-dig-host-tests-for-TCP-UDP-socket-error-
  * Remove CVE patches fixed upstream:
    - debian/patches/CVE-2022-1183.patch
      [Included in upstream release 9.18.3]
    - debian/patches/CVE-2022-2795.patch
    - debian/patches/CVE-2022-2881.patch
    - debian/patches/CVE-2022-2906.patch
    - debian/patches/CVE-2022-3080.patch
    - debian/patches/CVE-2022-38178.patch
      [Included in upstream release 9.18.7]
    - debian/patches/CVE-2022-3094.patch
    - debian/patches/CVE-2022-3736.patch
    -...

[Chris Halse Rogers (raof)]

The verification of the Stable Release Update for bind9 has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package bind9 - 1:9.18.12-0ubuntu0.22.10.1

---------------
bind9 (1:9.18.12-0ubuntu0.22.10.1) kinetic; urgency=medium

  * New upstream releases 9.18.5 - 9.18.12 (LP: #2003586)
    - Updates:
      + update-quota option
      + named -V shows supported cryptographic algorithms
    - Bug Fixes Include:
      + Fix crash when using dig with +nssearch and +tcp (LP: #1258003)
      + Fix incomplete results using dig with +nssearch (LP: #1970252)
      + CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080,
        CVE-2022-38178, CVE-2022-3094, CVE-2022-3736, CVE-2022-3924
      + Fix thread safety in dns_dispatch
      + Fix ADB quota management in resolver
      + Fix Prohibited DNS error on allow-recursion
      + Fix crash when restarting server with active statschannel connection
      + Fix use after free for catalog zone processing
      + Fix leak of dns_keyfileio_t objects
      + Fix nslookup failure to use port option when record type ANY is used
      + Fix crash on dnssec-policy zone with NSEC3 and inline-signing turned on
      + Fix inheritance when setting remote server port
      + Fix assertion error when accessing statistics channel
      + Fix rndc dumpdb -expired for stuck cache
      + Fix check for other name servers after receiving FORMERR
      + See https://bind9.readthedocs.io/en/v9_18_12/notes.html#notes-for-bind-9-18-12
        for additional bug fixes and information
  * Improve dep-8 test suite (LP: #2003584):
    - d/t/zonetest: Add dep8 test for checking the domain zone creation process
    - d/t/control: Add new test outline
  * d/bind9-doc.docs: Stop installing removed file doc/misc/options.active
  * d/p/0001-Disable-treat-warnings-as-errors-in-sphinx-build.patch: refresh to
    apply with version 9.18.8
  * Remove CVE patches fixed upstream:
    - debian/patches/CVE-2022-2795.patch
    - debian/patches/CVE-2022-2881.patch
    - debian/patches/CVE-2022-2906.patch
    - debian/patches/CVE-2022-3080.patch
    - debian/patches/CVE-2022-38178.patch
      [Included in upstream release 9.18.7]
    - debian/patches/CVE-2022-3094.patch
    - debian/patches/CVE-2022-3736.patch
    - debian/patches/CVE-2022-3924.patch
      [Included in upstream release 9.18.11]

 -- Lena Voytek <email address hidden> Wed, 08 Mar 2023 08:49:53 -0700