mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
e728d3506b
Please note that the fix for CVE-2024-52615 introduces CVE-2025-59529 which is not fixed yet (https://github.com/avahi/avahi/pull/808). You can mitigate this vulnerability by setting the `enable-wide-area=no` option. Patch `0011-properly-randomize-query-id-of-DNS-packets.patch` modify `configure.ac` and then `AVAHI_AUTORECONF` is set. This commit fixes the following vulnerabilities: - CVE-2021-3468: A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2021-3468 -447affe299- CVE-2023-38469: A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record. https://www.cve.org/CVERecord?id=CVE-2023-38469 - CVE-2023-38470: A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2023-38470 -a337a1ba7d- CVE-2023-38471: A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2023-38471 - github.com/avahi/avahi/commit/894f085f402e023a98cbb6f5a3d117bd88d93b09 - CVE-2023-38472: A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2023-38472 -b024ae5749- CVE-2023-38473: A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2023-38473 -b448c9f771- CVE-2024-52615: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2024-52615 -4e2e1ea090- https://github.com/avahi/avahi/issues/810 (introduce regression CVE-2025-59529) - CVE-2024-52616: A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2024-52616 -f8710bdc8b- CVE-2025-68276: Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-68276 -2d48e42d44- CVE-2025-68468: Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-68468 -f66be13d7f- CVE-2025-68471: Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-68471 -9c6eb53bf2- CVE-2026-24401: Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-24401 -78eab31128Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Julien Olivain <ju.o@free.fr>
53 lines
2.8 KiB
Diff
53 lines
2.8 KiB
Diff
From 20dec84b2480821704258bc908e7b2bd2e883b24 Mon Sep 17 00:00:00 2001
|
|
From: Evgeny Vereshchagin <evvers@ya.ru>
|
|
Date: Tue, 19 Sep 2023 03:21:25 +0000
|
|
Subject: [PATCH] [common] bail out when escaped labels can't fit into ret
|
|
|
|
Fixes:
|
|
```
|
|
==93410==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f9e76f14c16 at pc 0x00000047208d bp 0x7ffee90a6a00 sp 0x7ffee90a61c8
|
|
READ of size 1110 at 0x7f9e76f14c16 thread T0
|
|
#0 0x47208c in __interceptor_strlen (out/fuzz-domain+0x47208c) (BuildId: 731b20c1eef22c2104e75a6496a399b10cfc7cba)
|
|
#1 0x534eb0 in avahi_strdup avahi/avahi-common/malloc.c:167:12
|
|
#2 0x53862c in avahi_normalize_name_strdup avahi/avahi-common/domain.c:226:12
|
|
```
|
|
and
|
|
```
|
|
fuzz-domain: fuzz/fuzz-domain.c:38: int LLVMFuzzerTestOneInput(const uint8_t *, size_t): Assertion `avahi_domain_equal(s, t)' failed.
|
|
==101571== ERROR: libFuzzer: deadly signal
|
|
#0 0x501175 in __sanitizer_print_stack_trace (/home/vagrant/avahi/out/fuzz-domain+0x501175) (BuildId: 682bf6400aff9d41b64b6e2cc3ef5ad600216ea8)
|
|
#1 0x45ad2c in fuzzer::PrintStackTrace() (/home/vagrant/avahi/out/fuzz-domain+0x45ad2c) (BuildId: 682bf6400aff9d41b64b6e2cc3ef5ad600216ea8)
|
|
#2 0x43fc07 in fuzzer::Fuzzer::CrashCallback() (/home/vagrant/avahi/out/fuzz-domain+0x43fc07) (BuildId: 682bf6400aff9d41b64b6e2cc3ef5ad600216ea8)
|
|
#3 0x7f1581d7ebaf (/lib64/libc.so.6+0x3dbaf) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25)
|
|
#4 0x7f1581dcf883 in __pthread_kill_implementation (/lib64/libc.so.6+0x8e883) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25)
|
|
#5 0x7f1581d7eafd in gsignal (/lib64/libc.so.6+0x3dafd) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25)
|
|
#6 0x7f1581d6787e in abort (/lib64/libc.so.6+0x2687e) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25)
|
|
#7 0x7f1581d6779a in __assert_fail_base.cold (/lib64/libc.so.6+0x2679a) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25)
|
|
#8 0x7f1581d77186 in __assert_fail (/lib64/libc.so.6+0x36186) (BuildId: c9f62793b9e886eb1b95077d4f26fe2b4aa1ac25)
|
|
#9 0x5344a4 in LLVMFuzzerTestOneInput /home/vagrant/avahi/fuzz/fuzz-domain.c:38:9
|
|
```
|
|
|
|
It's a follow-up to 94cb6489114636940ac683515417990b55b5d66c
|
|
|
|
CVE: CVE-2023-38470
|
|
Upstream: https://github.com/avahi/avahi/commit/20dec84b2480821704258bc908e7b2bd2e883b24
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
avahi-common/domain.c | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/avahi-common/domain.c b/avahi-common/domain.c
|
|
index e66d2416c..88c6f0114 100644
|
|
--- a/avahi-common/domain.c
|
|
+++ b/avahi-common/domain.c
|
|
@@ -210,7 +210,8 @@ char *avahi_normalize_name(const char *s, char *ret_s, size_t size) {
|
|
} else
|
|
empty = 0;
|
|
|
|
- avahi_escape_label(label, strlen(label), &r, &size);
|
|
+ if (!(avahi_escape_label(label, strlen(label), &r, &size)))
|
|
+ return NULL;
|
|
}
|
|
|
|
return ret_s;
|