Can this be used to exploit DNS servers via other rogue DNS servers? What if I setup a rogue DNS and wait for it to be queried by 8.8.8.8. When I own 8.8.8.8 I can exploit every client that queries it. Browsers use getaddrinfo(), don't they?
My point is that if you could use this bug to use one rogue DNS to own other DNSes this could be leveraged to bring large parts of the Internet down.
I don't know how hard or easy this could be. A quick glance into PDNS reveals four calls to getaddrinfo()[1]. So it might be possible...
[1] https://github.com/PowerDNS/pdns/search?utf8=%E2%9C%93&q=get...
One uses AI_NUMERICHOST and thus doesn't do any DNS client activity. A second isn't supplied arbitrary domain names as input, they being the ones configured for the location of a specific back-end data source by the server administrator. The third is used only inside a "zone transfer" subsystem and again isn't supplied arbitrary domain names as input, the domain names again being in local data specified by the server administrator.
And the fourth is not even part of the executable program, the code being disabled with #if 0 .
The "S" in "DNS" stands for "system", not "server", by the way. A rogue DNS server would "own" other DNS servers.
A quick search in the PowerDNS codebase [1] reveals four sites where getaddrinfo() is called. This isn't obviously the code for recursive lookups but that doesn't matter. If an attacker can trick it to query their rogue DNS they have won.
I don't want to suggest that Google uses PowerDNS, I just used is as an example.
[1] https://github.com/PowerDNS/pdns/search?utf8=%E2%9C%93&q=get...