Saint SAD DNS, Who Poisoned the Cache With Noise

Patron of DNS resolvers, UDP ports that let themselves be guessed, and everyone who thought cache poisoning was buried.

Life

In 2020 researchers from the University of California, Riverside, and Tsinghua University brought DNS cache poisoning back to life with SAD DNS. A side channel in the Linux kernel's ICMP rate limiting let an off-path attacker quickly guess the source UDP port, defeating its randomisation, and inject forged answers into the resolver. It hit BIND, Unbound and dnsmasq, and the flaw kept returning in variants over the following years.

Prayer

O Saint SAD DNS, who listens to the kernel's noise to guess the port, let our resolvers not be read in secret. Amen.

How to celebrate

Celebrated by updating the Linux kernel and the resolvers, and preferring DNS over TLS or HTTPS where possible.

Let the port be guessed and you let the stranger in.