DNS Cache Poisoning Attack: Resurrections with Side Channels

2 min read

After SAD DNS was patched, the same group used ICMP error messages, which by design never get a reply, as the probe. Linux handles ICMP “fragmentation needed” and “redirect” messages by updating a global next-hop exception cache, but only after checking that the UDP header quoted inside the ICMP message matches a live socket. So a spoofed ICMP message changes the cache only when it names an open ephemeral port, and the attacker reads the change back, for example through the path MTU of a later reply. BIND’s sockets are connected to the name server, so the change is private to that server’s address. The attacker gets round this with hash collisions: the cache is a 2048-bucket table whose buckets hold a few entries and evict the oldest, so with addresses that land in the name server’s bucket, an eviction becomes visible. Redirects can also mute the name server.

Findings

  • About 38% of open resolvers by frontend IP and 14% by backend IP were vulnerable, including OpenDNS and Quad9.
  • End to end against BIND 9.16.13 on Linux 5.11.16 over IPv6, poisoning took 1.3 to 15.6 minutes on average depending on the setup, including runs with background load equal to a 70-million-queries-a-day resolver (about 810 queries per second).
  • About 3,500 IPv4 addresses are enough to find colliding sets for some bucket. The exception cache that creates the channel arrived in Linux 3.6 for IPv4 and 4.15 for IPv6.
  • Proposed fixes: the IP_PMTUDISC_OMIT socket option with a TCP fallback, randomising the cache (list length, eviction, a periodically re-keyed hash), and ignoring ICMP redirects on hosts with one gateway.

Limits

  • Needs spoofing and a one-off collision search per resolver, whose time is not counted in the attack time.
  • Tested in a controlled setup with simulated loss, jitter and delay.
  • Each fix is a point patch. The authors’ general advice is to share as little state as possible and randomise what must be shared.

Relevance

Patch one shared counter and a shared table leaks instead. For robot stacks (DDS middleware, shared maps, rate limits on a shared radio), it is unclear which shared structures an off-board attacker can both touch and read back, a problem for robot-security and robust robotics. SCAD is the same group’s attempt to find such channels automatically.