CVE-2018-1110
📋 TL;DR
A vulnerability in knot-resolver DNS software allows malformed DNS messages to cause denial of service by crashing the service. This affects organizations running knot-resolver versions before 2.3.0 as their DNS resolver.
💻 Affected Systems
- knot-resolver
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
DNS service becomes completely unavailable, disrupting all DNS resolution for dependent systems and services.
Likely Case
Intermittent DNS service outages requiring manual restart of knot-resolver processes.
If Mitigated
Minimal impact with proper network segmentation and monitoring to detect and respond to attacks quickly.
🎯 Exploit Status
Exploitation requires sending specially crafted DNS packets to the vulnerable resolver.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.0 and later
Vendor Advisory: https://www.knot-resolver.cz/2018-04-23-knot-resolver-2.3.0.html
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update knot-resolver to version 2.3.0 or later using your package manager. 3. Restart the knot-resolver service.
🔧 Temporary Workarounds
Rate limiting DNS queries
linuxImplement rate limiting to reduce impact of DoS attacks
# Configure in knot-resolver config file
policy.add(policy.suffix(policy.DENY, {todname('example.com')}))
🧯 If You Can't Patch
- Implement network-level filtering to block malformed DNS packets
- Deploy redundant DNS resolvers with load balancing to maintain service during attacks
🔍 How to Verify
Check if Vulnerable:
Check knot-resolver version with 'kresd --version' or package manager queryCheck Version:
kresd --version 2>/dev/null || rpm -q knot-resolver || dpkg -l knot-resolverVerify Fix Applied:
Confirm version is 2.3.0 or later and service is running without crashes📡 Detection & Monitoring
Log Indicators:
- Unexpected knot-resolver process crashes
- DNS query timeouts
- High error rates in DNS logs
Network Indicators:
- Unusual DNS query patterns
- Spike in malformed DNS packets
SIEM Query:
source="knot-resolver" AND (event="crash" OR event="error")