CVE-2021-3468: Medium severity Avahi Avahi vulnerability
A flaw was found in avahi deamon. Denial of service can be triggered by writing long lines to /run/avahi-daemon/socket resulting in an unresponsive busy-loop of the daemon.
References:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=984938
Other sources
A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the clientwork function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/avahito a version that resolves this vulnerability.Fixed in 0.8-7Fixed in 0.8-5+deb11u2 - Upgrade
Upgrade
debian/avahito a version that resolves this vulnerability.Fixed in 0.8-5+deb11u2Fixed in 0.8-5+deb11u3Fixed in 0.8-10+deb12u1Fixed in 0.8-16Fixed in 0.8-17 - Compensating control
Mitigate the local denial-of-service by restricting access to the Avahi daemon Unix socket at /run/avahi-daemon/socket so that only trusted local users/services can write to it.
Event History
Frequently Asked Questions
What is CVE-2021-3468?
CVE-2021-3468 is a vulnerability found in avahi versions 0.6 up to 0.8 where a flaw in how the termination of the client connection on the avahi Unix socket is handled can allow a local attacker to trigger an infinite loop.
What is the severity of CVE-2021-3468?
The severity of CVE-2021-3468 is medium with a CVSS v3 base score of 5.5.
Which software versions of avahi are affected?
Versions 0.6 up to 0.8 of avahi are affected by CVE-2021-3468.
How can a local attacker exploit CVE-2021-3468?
A local attacker can exploit CVE-2021-3468 by triggering an infinite loop through the mishandling of the client connection termination event on the avahi Unix socket.
Are there any fixes or patches available for CVE-2021-3468?
Yes, there are fixes and patches available for CVE-2021-3468. It is recommended to update to a version of avahi that is not affected by this vulnerability.