PT-2021-4070 · Avahi+5 · Avahi+5

Thomas Kremer · Published 2021-03-27 · Updated 2024-06-26 · CVE-2021-3502

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions avahi version 0.8-5

Description A flaw in the avahi service allows a local attacker to crash the service by requesting hostname resolutions for invalid hostnames through the avahi socket or dbus methods. This is due to a reachable assertion in the avahi s host name resolver start function. The highest threat from this issue is to service availability. Exploitation of this flaw can lead to a denial of service.

Recommendations For avahi version 0.8-5, as a temporary workaround, consider disabling the avahi s host name resolver start function until a patch is available. Restrict access to the avahi socket and dbus methods to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

NULL Pointer Dereference

Assertion Failure

Weakness Enumeration

CWE-476

CWE-617

Related Identifiers

ALSA-2023:6707

AZL-40943

BDU:2021-04611

CVE-2021-3502

MGASA-2021-0339

OPENSUSE-SU-2024:10643-1

RHSA-2023:6707

RHSA-2023_6707

USN-5008-1

Affected Products

Almalinux

Linuxmint

Red Hat

Red Os

Ubuntu

Avahi

References · 45

• 🔥 https://github.com/lathiat/avahi/issues/338 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1946914 · Exploit
• https://osv.dev/vulnerability/MGASA-2021-0339 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-3502 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10643-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3468 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3502 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/USN-5008-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3502 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3502 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04611 · Security Note
• https://advisories.mageia.org/MGASA-2021-0339.html · Security Note
• https://ubuntu.com/security/notices/USN-5008-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-40943 · Vendor Advisory