Futile Waiting: A Memory Exhaustion DoS Attack on DNS Resolvers

The Domain Name System (DNS), one of the core services on the Internet, has become an attractive target for attackers. In this paper, we present a novel resource consuming attack named MemoryDeadlock that targets DNS resolvers. With this attack, merely a single malicious query directed at a DNS resolver is able to substantially boost its memory load. Even just a few of these concurrent queries are able to cause resource depletion, thereby denying service to legitimate clients. This attack capitalizes on an algorithmic flaw in the manner by which recursive resolvers handle Cross-Domain Circular Delegation Dependency Chain within authoritative name servers. Experimental measurements demonstrate that the attack is able to magnify the memory load by as much as 20 -fold on a BIND9 based resolver, and this amplification factor constitutes a non-trivial value in relation to the effective memory resources. Furthermore, We have reported vulnerabilities to affected vendors and provided them with mitigation recommendations. Until now, BIND has taken proactive measures to address vulnerabilities based on our recommendations.