CVE-2023-38471

Avahi, a system for service discovery on a local network via mDNS/DNS-SD, prior to version 0.9-rc4 is vulnerable to a DoS attack. Any unprivileged local user can send a single D-Bus method call with conflicting publish flags, causing avahi-daemon to crash.

Avahi in versions 0.9rc2 and below allows crashing avahi-daemon via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record where the alias and canonical name point to the same domain. This causes unbounded recursion in lookup_handle_cname and stack exhaustion. The vulnerability affects record browsers with AVAHI_LOOKUP_USE_MULTICAST explicitly set, including those created by resolvers used by nss-mdns.

A vulnerability in Avahi (up to and including 0.9-rc5) allows the simple protocol server to ignore the documented client limit (CLIENTS_MAX) and accept unlimited connections. This enables unprivileged local users to exhaust daemon memory and file descriptors, causing a local denial of service (DoS). No official patched version is available, but a candidate fix exists in pull request 808.

A vulnerability exists in Avahi where a reachable assertion occurs in the avahi_alternative_host_name() function. Malformed input can cause the Avahi daemon to abort.

A vulnerability exists in Avahi where a reachable assertion occurs in the avahi_rdata_parse() function. Crafted DNS records can cause the daemon to abort.

A vulnerability exists in Avahi where a reachable assertion occurs in the avahi_escape_label() function. Malformed input can cause the daemon to abort.

A vulnerability exists in Avahi where a reachable assertion occurs in avahi_dns_packet_append_record. Crafted DNS packets can cause the daemon to abort.