CVE-2026-79981: crypto in zephyrproject zephyr

The DNS stub resolver in Zephyr binds one UDP socket per configured server with a fixed ephemeral source port for the lifetime of the resolver context, while only the 16-bit transaction ID varies per query. This violates RFC 5452 section 9.2, which requires both source port and transaction ID to vary to prevent off-path DNS spoofing. The stable source port can be discovered by an attacker through observation or probing, and the resolver accepts replies based solely on transaction ID and a CRC-16 of the queried name, without verifying the source address. An attacker with UDP reachability can flood forged DNS answers across the 16-bit transaction ID space to race legitimate responses, potentially causing applications to resolve attacker-chosen addresses. The vulnerability is mitigated by a fix that randomizes the source port before each query to a server with no outstanding queries, increasing the guessing space from about 16 bits to about 31 bits. This fix is controlled by the configuration option CONFIG_DNS_RESOLVER_RANDOMIZE_SOURCE_PORT, enabled by default. Multicast DNS and LLMNR are excluded due to fixed protocol ports.

An off-path attacker with UDP reachability to the affected device can predict the stable source port used by the DNS resolver and flood forged DNS responses to race legitimate server replies. Successful exploitation can cause applications to resolve attacker-chosen IP addresses, potentially redirecting traffic or enabling man-in-the-middle attacks. However, the attack requires winning the race against legitimate responses, and applications that validate TLS certificates are largely protected. The vulnerability does not affect availability or confidentiality directly but impacts integrity of DNS resolution.

A patch is available that randomizes the source port for each DNS query to servers without outstanding queries, significantly increasing the difficulty of guessing the source port and transaction ID combination. This fix is enabled by default via CONFIG_DNS_RESOLVER_RANDOMIZE_SOURCE_PORT. Users should upgrade to Zephyr version 4.5.0 or later where this fix is included. No additional mitigation is required if the patch is applied. Applications performing TLS certificate validation are less impacted by this vulnerability.