Saint TuDoor, Doorkeeper of Resolvers

Patron of DNS resolvers, malformed packets, and everyone who thinks cache poisoning is so 2008.

Life

A team of researchers led by Tsinghua University found three logic flaws in how DNS resolvers pre-process responses: with malformed packets one could poison caches, deny service or exhaust resources. Twenty-four DNS programs were affected, including Windows DNS, BIND and PowerDNS, along with routers and public services, and 33 CVEs were assigned. The work was later presented at IEEE S&P 2024.

Prayer

O Saint TuDoor, who knocks on the resolvers' door with crooked packets, let our DNS throw away what it does not understand. Amen.

How to celebrate

Celebrated by updating the resolver and checking that your router isn't secretly running DNS too.

A crooked packet in the cache sends you to a crooked address.