CVE-2021-3502: Null Pointer Dereference
A flaw was found in avahi 0.8-5. A reachable assertion is present in avahishostnameresolverstart function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.
Other sources
A local Dos in avahi-daemon that can be triggered by trying to resolve badly-formatted hostnames on the /run/avahi-daemon/socket interface.
References:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=986018
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/avahito a version that resolves this vulnerability.Fixed in 0.8-5+deb11u2Fixed in 0.8-5+deb11u3Fixed in 0.8-10+deb12u1Fixed in 0.8-16Fixed in 0.8-17 - Upgrade
Upgrade
avahito a version that resolves this vulnerability.Fixed in 0.8-5 - Compensating control
To reduce impact while fixing, restrict access to the avahi service so only trusted local clients can reach the /run/avahi-daemon/socket interface and the avahi socket/dbus hostname-resolution methods.
Event History
Frequently Asked Questions
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2021-3502.
What is the severity of CVE-2021-3502?
The severity of CVE-2021-3502 is medium, with a CVSSv3 score of 5.5.
Which software version is affected by CVE-2021-3502?
The Avahi software version 0.8-5 is affected by CVE-2021-3502.
How can a local attacker exploit this vulnerability?
A local attacker can crash the Avahi service by requesting hostname resolutions through the avahi socket or dbus methods with invalid hostnames.
Are there any references for further information about CVE-2021-3502?
Yes, you can find more information about CVE-2021-3502 in the following references: 1. [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1946914) 2. [Avahi GitHub Issue](https://github.com/lathiat/avahi/issues/338)