A tale of a DNS exploit: CVE-2015-7547

This post details the discovery and analysis of CVE-2015-7547, a buffer overflow vulnerability in GNU libc's DNS stub resolver. It provides proof-of-concept exploits for both on-path and off-path scenarios, demonstrating how attackers can achieve memory corruption and remote code execution by manipulating DNS responses. The post critically evaluates and debunks proposed mitigations like limiting DNS response sizes, highlighting their ineffectiveness and potential for harm. It emphasizes the critical need for immediate patching and suggests running local caching resolvers as a partial defense, while also illustrating a cache traversal attack against djbdns' dnscache.