A deep look at CVE-2015-5477 and how CloudFlare Virtual DNS customers are protected

This post details a specific DNS exploit (CVE-2015-5477) in BIND9 that causes a crash due to a failed assertion when handling TKEY queries. It provides a deep dive into the vulnerable code, tracing the bug flow from the `dns_message_findname` function to the `dns_tkey_processquery` function. The post explains how a non-TKEY record in the EXTRA section, combined with a subsequent call to `dns_message_findname` without resetting the `name` pointer, triggers the assertion failure. It also highlights that Cloudflare's Virtual DNS customers were protected because their custom Go DNS server, RRDNS, sanitizes queries and does not relay EXTRA section records for TKEY queries.