[Paper Review] ResolverFuzz: Automated Discovery of DNS Resolver Vulnerabilities with Query-Response Fuzzing

Qifan Zhang, Xuesong Bai+4 more|arXiv (Cornell University)|Oct 4, 2023

Software Testing and Debugging TechniquesComputer Science3 citations

TL;DR

ResolverFuzz is a blackbox fuzzing framework that automates the discovery of DNS resolver vulnerabilities through constrained stateful query-response mutation using probabilistic context-free grammar (PCFG) and byte-level mutation. It detects non-crash bugs like cache poisoning via differential testing and clustering, uncovering 23 vulnerabilities—15 assigned CVEs—across major DNS software.

ABSTRACT

Domain Name System (DNS) is a critical component of the Internet. DNS resolvers, which act as the cache between DNS clients and DNS nameservers, are the central piece of the DNS infrastructure, essential to the scalability of DNS. However, finding the resolver vulnerabilities is non-trivial, and this problem is not well addressed by the existing tools. To list a few reasons, first, most of the known resolver vulnerabilities are non-crash bugs that cannot be directly detected by the existing oracles (or sanitizers). Second, there lacks rigorous specifications to be used as references to classify a test case as a resolver bug. Third, DNS resolvers are stateful, and stateful fuzzing is still challenging due to the large input space. In this paper, we present a new fuzzing system termed ResolverFuzz to address the aforementioned challenges related to DNS resolvers, with a suite of new techniques being developed. First, ResolverFuzz performs constrained stateful fuzzing by focusing on the short query-response sequence, which has been demonstrated as the most effective way to find resolver bugs, based on our study of the published DNS CVEs. Second, to generate test cases that are more likely to trigger resolver bugs, we combine probabilistic context-free grammar (PCFG) based input generation with byte-level mutation for both queries and responses. Third, we leverage differential testing and clustering to identify non-crash bugs like cache poisoning bugs. We evaluated ResolverFuzz against 6 mainstream DNS software under 4 resolver modes. Overall, we identify 23 vulnerabilities that can result in cache poisoning, resource consumption, and crash attacks. After responsible disclosure, 19 of them have been confirmed or fixed, and 15 CVE numbers have been assigned.

Motivation & Objective

• To address the challenge of discovering non-crash, semantic bugs in DNS resolvers that evade traditional fuzzing oracles.
• To overcome the lack of rigorous specifications for DNS resolver behavior, especially for cache poisoning and resource consumption bugs.
• To enable effective stateful fuzzing by focusing on short query-response sequences, which are most effective for triggering known resolver vulnerabilities.
• To reduce manual triage effort for inconsistent behaviors by clustering test cases using bisecting K-means.
• To build a scalable, production-safe test infrastructure that localizes nameserver hierarchies and enables concurrent resolver testing.

Proposed method

• Applies constrained stateful fuzzing by mutating only a single query-response pair, based on empirical evidence that such sequences trigger most known resolver vulnerabilities.
• Combines probabilistic context-free grammar (PCFG) for syntactically valid DNS message generation with byte-level mutation to increase input diversity and coverage.
• Employs differential testing across multiple resolver implementations to detect inconsistent behaviors indicative of cache poisoning or resource consumption vulnerabilities.
• Uses a novel bisecting K-means clustering technique to group inconsistent test cases, significantly reducing manual investigation effort.
• Introduces a local, isolated test infrastructure to emulate DNS name server hierarchies and avoid impacting public DNS resolvers during fuzzing.
• Leverages lightweight monitoring tools (e.g., tcpdump, cache dumps) for blackbox testing without code instrumentation or binary rewriting.

Experimental results

Research questions

• RQ1 Can constrained stateful fuzzing on short query-response sequences effectively trigger a high proportion of known DNS resolver vulnerabilities?
• RQ2 How can grammar-based and mutation-based input generation improve the discovery of semantic bugs in DNS resolvers?
• RQ3 To what extent can differential testing and clustering reduce the manual effort required to triage false positives in inconsistent resolver behaviors?
• RQ4 Can a blackbox fuzzing framework detect non-crash vulnerabilities like cache poisoning and resource exhaustion in production-grade DNS software?
• RQ5 How effective is the proposed infrastructure in enabling high-throughput, safe, and scalable fuzzing of multiple resolver modes?

Key findings

• ResolverFuzz discovered 23 previously unknown vulnerabilities in 6 mainstream DNS software across 4 resolver modes (recursive-only, forward-only, CDNS with/without fallback).
• Of these, 19 vulnerabilities were confirmed or fixed after responsible disclosure, and 15 were assigned CVE identifiers.
• One critical vulnerability ($CP1$) allows complete bypass of bailiwick checking, enabling off-path cache poisoning of any domain in a TLD zone (e.g., .com domains).
• The test generator achieved strong coverage of valid DNS message structures, with PCFG and byte-level mutation significantly increasing effective mutation diversity.
• Differential testing successfully identified 23 inconsistent behaviors, and clustering reduced triage effort by grouping semantically similar edge cases.
• The local test infrastructure enabled concurrent testing of multiple resolvers without affecting public DNS services, supporting high-throughput fuzzing.