Skip to content

Instantly share code, notes, and snippets.

@vavrusa

vavrusa/cve-2015-7547-mitigation.md

Last active February 17, 2016 13:20
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save vavrusa/1aa1700b68d66611e6e1 to your computer and use it in GitHub Desktop.
Save vavrusa/1aa1700b68d66611e6e1 to your computer and use it in GitHub Desktop.
Download ZIP
cve-2015-7547-mitigation
Raw
cve-2015-7547-mitigation.md

Mitigating with local resolver

There are two preconditions for the attack:

  1. One of the queries results in 2k valid answer
  2. One of the queries soft-fails and will be retried

Mitigating (1) with UDP is simple: set maximum UDP buffer size to <2048B 1 That leaves TCP.

To make one of the A,AAAA fail by the upstream (2) can be done by making the resolution chain overly long (attacker is not between stub-resolver), so glibc timeouts and retries. At this point if the glibc retries, resolver MUST NOT ask the origin again otherwise it might provide attack payload. If the resolver caches the previous negative answer or queues the second query to the former one that is being still resolved, the preconditions are met, but the attack payload never reaches the client. This can be mitigated by cache-min-ttl (higher than RTT between stub-resolver, say 5s) for negative answers.

Note: Knot DNS Resolver has 5s minimum cache TTL for negative/failed answers, so that's covered.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment