What is Knot Resolver

Knot Resolver is an open-source caching DNS recursive resolver developed by CZ.NIC (the .cz registry). It resolves DNS queries on behalf of clients — end-user devices, ISP resolver fleets, and public resolver services — and caches the answers. It supports modern encrypted transports including DNS-over-TLS (DoT), DNS-over-HTTPS (DoH) and DNS-over-QUIC (DoQ), and ships DNSSEC validation and aggressive caching.

It is popular in large ISP environments, where its rich feature set (scriptable policy, DNSSEC, encrypted transports, fine-grained caching) and high performance make it well suited to serving very large subscriber bases.

The daemon (kresd) is a long-lived network service that is directly exposed to untrusted input from any host able to reach its listening port. That makes a memory-corruption bug in its packet-receive path — like the one exploited here — a remotely reachable, unauthenticated attack surface: compromising the resolver lets an attacker forge DNS answers for every downstream client, i.e. redirect or intercept effectively all of their traffic.

Root cause

kr_recv_stream_data_cb() reassembles DoQ STREAM frames into a per-connection input buffer (pers_inbuf). It grows that buffer with

instead of setting the size to the new total. Across several frames the tracked size drifts above the real allocation. A final frame whose datalen fits under the inflated size therefore skips the reallocation, yet the subsequent memcpy() is bounded by that inflated size — so it writes past the end of the object. jemalloc keeps the object pinned to its real size class, so the excess bytes land in the adjacent slab slot.

Exploitation summary

A six-frame sequence on one stream walks pers_inbuf through five jemalloc size classes into the 6144-byte class and then overflows into the neighbouring slot:

Lightweight connection grooming (open several DoQ connections, free half just before firing) arranges for slot+1 to hold a libgnutls cleanup handler. The overflow overwrites that handler's dispatch pointer, its argument, and the flag that gates the dispatch. During connection teardown libgnutls executes

giving control of the instruction pointer (RIP) and the first argument (RDI). The PoC routes this to system() with a pointer to an attacker-supplied command string written into the same slot.

Scope: ASLR

This PoC targets a host with ASLR disabled (kernel.randomize_va_space = 0). With randomization off the heap and libc addresses are deterministic, so the two addresses the exploit needs (slot+1 and system()) are constants for a given build. Defeating ASLR is a separate problem and is intentionally out of scope here — the goal is to demonstrate the memory-corruption → control-flow → code-execution primitive in isolation.

Because those addresses are deterministic, no information leak is required: the exploit runs fully over the network from a remote host. The addresses are recovered once with the probe step (below) on any identical build and then hard-coded; on the reference build they are slot+1 = 0x7ffff66c5000 and system = 0x7ffff746a490.

Contents

Requires Python 3 with aioquic and netcat on the attacker side, and gdb on the target only for the one-time probe step.

Usage — remote reverse shell (no info leak)

This is the headline demonstration: the exploit is fired from the attacker machine, over the network, with the two deterministic addresses hard-coded. Nothing is read from the target — no /proc, no gdb, no logs.

Each round that lands calls system() on the target with a reverse-shell command; the shell connects back to --lhost:--lport, where nc receives it. When it arrives, type into the netcat session to drive the shell:

The --slot1 / --system values are recovered once with the probe step on any identical build; they are constants while ASLR is off.

Recovering the addresses (one-time probe)

The --slot1 / --system values above are constants while ASLR is off; recover them once on any identical build. Precondition:

poc.py rip --rounds 8 additionally demonstrates raw RIP/RDI control (the target crashes at the attacker-chosen instruction pointer).

Reliability

Measured on the reference build (Debian 12, 6.3.0-cznic.1, ASLR off):

The gap is inherent: system() runs on a heap that the overflow just corrupted, so most dispatches crash kresd before the child is spawned. The daemon is respawned by its supervisor after each crash, the address is deterministic with ASLR off, and each attempt is independent — so the exec loop simply retries until one lands (in the remote run above, a shell arrived on round 5). A failed attempt is a transient worker crash (DoS). Grooming parameters --groom 16 --close 8 --qpc 4 are the empirically best defaults; heavier closing (e.g. --close 16 at --groom 32) collapses the hit rate.

Reference environment

The size-class geometry (six frames, 1200/1440-byte payloads) and the libgnutls dispatch offset are specific to this build; other builds need the frame sizes and offsets re-derived.

Disclosure timeline

Disclosure & license

Reported to the vendor on 2026-06-08 and released in coordination with the official fix (6.4.1, 2026-07-22). Provided for authorized testing, defensive validation, and research. Do not run it against systems you do not own or are not explicitly authorized to test.

SPDX-License-Identifier: MIT