A deep look at CVE-2015-5477 and how CloudFlare Virtual DNS customers are protected

What this post added

This post details the analysis of CVE-2015-5477, a critical remotely exploitable vulnerability in BIND9 DNS servers. It explains the root cause of the crash, which is a failed assertion in `dns_message_findname` due to a dirty `name` pointer being passed in a second call after a previous call failed to find a TKEY record but still populated the `name` pointer. The post also highlights how Cloudflare's Virtual DNS customers were protected from this vulnerability due to their use of RRDNS, which sanitizes queries and does not relay EXTRA section records for TKEY queries.