mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-01 21:23:51 -09:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
buildroot/package/avahi/0009-core-make-sure-there-is-rdata-to-process-before-parsing-it.patch
Thomas Perale e728d3506b package/avahi: patch various security vulnerabilities 
Please note that the fix for CVE-2024-52615 introduces CVE-2025-59529
which is not fixed yet (https://github.com/avahi/avahi/pull/808). You
can mitigate this vulnerability by setting the `enable-wide-area=no`
option.

Patch `0011-properly-randomize-query-id-of-DNS-packets.patch` modify
`configure.ac` and then `AVAHI_AUTORECONF` is set.

This commit fixes the following vulnerabilities:

- CVE-2021-3468:
    A flaw was found in avahi in versions 0.6 up to 0.8. The event used to
    signal the termination of the client connection on the avahi Unix
    socket is not correctly handled in the client_work function, allowing
    a local attacker to trigger an infinite loop. The highest threat from
    this vulnerability is to the availability of the avahi service, which
    becomes unresponsive after this flaw is triggered.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2021-3468
    - 447affe299

- CVE-2023-38469:
    A vulnerability was found in Avahi, where a reachable assertion exists
    in avahi_dns_packet_append_record.
    https://www.cve.org/CVERecord?id=CVE-2023-38469

- CVE-2023-38470:
    A vulnerability was found in Avahi. A reachable assertion exists in
    the avahi_escape_label() function.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2023-38470
    - a337a1ba7d

- CVE-2023-38471:
    A vulnerability was found in Avahi. A reachable assertion exists in
    the dbus_set_host_name function.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2023-38471
    - github.com/avahi/avahi/commit/894f085f402e023a98cbb6f5a3d117bd88d93b09

- CVE-2023-38472:
    A vulnerability was found in Avahi. A reachable assertion exists in
    the avahi_rdata_parse() function.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2023-38472
    - b024ae5749

- CVE-2023-38473:
    A vulnerability was found in Avahi. A reachable assertion exists in
    the avahi_alternative_host_name() function.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2023-38473
    - b448c9f771

- CVE-2024-52615:
    A flaw was found in Avahi-daemon, which relies on fixed source ports
    for wide-area DNS queries. This issue simplifies attacks where
    malicious DNS responses are injected.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2024-52615
    - 4e2e1ea090
    - https://github.com/avahi/avahi/issues/810 (introduce regression CVE-2025-59529)

- CVE-2024-52616:
    A flaw was found in the Avahi-daemon, where it initializes DNS
    transaction IDs randomly only once at startup, incrementing them
    sequentially after that. This predictable behavior facilitates DNS
    spoofing attacks, allowing attackers to guess transaction IDs.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2024-52616
    - f8710bdc8b

- CVE-2025-68276:
    Avahi is a system which facilitates service discovery on a local
    network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an
    unprivileged local users can crash avahi-daemon (with wide-area
    disabled) by creating record browsers with the
    AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by
    either calling the RecordBrowserNew method directly or creating
    hostname/address/service resolvers/browsers that create those browsers
    internally themselves.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2025-68276
    - 2d48e42d44

- CVE-2025-68468:
    Avahi is a system which facilitates service discovery on a local
    network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier,
    avahi-daemon can be crashed by sending unsolicited announcements
    containing CNAME resource records pointing it to resource records with
    short TTLs. As soon as they expire avahi-daemon crashes.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2025-68468
    - f66be13d7f

- CVE-2025-68471:
    Avahi is a system which facilitates service discovery on a local
    network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier,
    avahi-daemon can be crashed by sending 2 unsolicited announcements
    with CNAME resource records 2 seconds apart.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2025-68471
    - 9c6eb53bf2

- CVE-2026-24401:
    Avahi is a system which facilitates service discovery on a local
    network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and
    below, avahi-daemon can be crashed via a segmentation fault by sending
    an unsolicited mDNS response containing a recursive CNAME record,
    where the alias and canonical name point to the same domain (e.g.,
    "h.local" as a CNAME for "h.local"). This causes unbounded recursion
    in the lookup_handle_cname function, leading to stack exhaustion. The
    vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST
    is set explicitly, which includes record browsers created by resolvers
    used by nss-mdns. This issue is patched in commit
    78eab31128479f06e30beb8c1cbf99dd921e2524.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2026-24401
    - 78eab31128

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-13 09:45:23 +01:00

43 lines
2.1 KiB
Diff
Raw Permalink Blame History

From b024ae5749f4aeba03478e6391687c3c9c8dee40 Mon Sep 17 00:00:00 2001
From: Michal Sekletar <msekleta@redhat.com>
Date: Thu, 19 Oct 2023 17:36:44 +0200
Subject: [PATCH] core: make sure there is rdata to process before parsing it
Fixes #452
CVE: CVE-2023-38472
Upstream: https://github.com/avahi/avahi/commit/b024ae5749f4aeba03478e6391687c3c9c8dee40
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
avahi-client/client-test.c | 3 +++
avahi-daemon/dbus-entry-group.c | 2 +-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/avahi-client/client-test.c b/avahi-client/client-test.c
index b3366d848..ba9799881 100644
--- a/avahi-client/client-test.c
+++ b/avahi-client/client-test.c
@@ -258,6 +258,9 @@ int main (AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char *argv[]) {
printf("%s\n", avahi_strerror(avahi_entry_group_add_service (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "Lathiat's Site", "_http._tcp", NULL, NULL, 80, "foo=bar", NULL)));
printf("add_record: %d\n", avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "\5booya", 6));
+ error = avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "", 0);
+ assert(error != AVAHI_OK);
+
avahi_entry_group_commit (group);
domain = avahi_domain_browser_new (avahi, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, NULL, AVAHI_DOMAIN_BROWSER_BROWSE, 0, avahi_domain_browser_callback, (char*) "omghai3u");
diff --git a/avahi-daemon/dbus-entry-group.c b/avahi-daemon/dbus-entry-group.c
index 4e879a5ba..aa23d4b6b 100644
--- a/avahi-daemon/dbus-entry-group.c
+++ b/avahi-daemon/dbus-entry-group.c
@@ -340,7 +340,7 @@ DBusHandlerResult avahi_dbus_msg_entry_group_impl(DBusConnection *c, DBusMessage
if (!(r = avahi_record_new_full (name, clazz, type, ttl)))
return avahi_dbus_respond_error(c, m, AVAHI_ERR_NO_MEMORY, NULL);
- if (avahi_rdata_parse (r, rdata, size) < 0) {
+ if (!rdata || avahi_rdata_parse (r, rdata, size) < 0) {
avahi_record_unref (r);
return avahi_dbus_respond_error(c, m, AVAHI_ERR_INVALID_RDATA, NULL);
}
Reference in New Issue View Git Blame Copy Permalink