Critical Vulnerability in Avahi Package: Unprivileged User Can Crash Daemon
Summary
ALPINE-CVE-2023-1981: A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash. Affects avahi versions < 0.8-r14. Fixed in 0.8-r14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Avahi is a widely used open-source implementation of the DNS Service Discovery (DNS-SD) and Multicast DNS (mDNS) protocols. It enables networked devices to discover each other and communicate seamlessly without the need for manual configuration. The Avahi library is integral for applications that require service discovery on local networks. However, it has been found to have a vulnerability that allows unprivileged users to exploit the system, leading to potential denial of service.
Vulnerability Detail
A vulnerability was identified in the Avahi library that allows an unprivileged user to make a D-Bus call, which can cause the Avahi daemon to crash. This flaw can be exploited by attackers to disrupt services that rely on Avahi for network discovery, potentially leading to service outages and affecting the overall functionality of applications that depend on this library. The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
0.8-r14
This is the first release that contains the fix.
sudo apk add --upgrade avahiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the D-Bus interface used by Avahi to prevent unprivileged users from making calls that could lead to a crash. This can be done by modifying the D-Bus configuration files to limit access permissions.
Conclusion
The Avahi package has a critical vulnerability that allows unprivileged users to crash the daemon, posing a risk to applications that depend on it for service discovery. It is essential to update to the patched version 0.8-r14 to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in your software effectively.
See every vulnerability recorded for avahi →
FAQ
The vulnerability allows unprivileged users to crash the Avahi daemon, leading to potential service disruptions for applications relying on Avahi for network discovery.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities in real-time.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
Yes, a patched version of the Avahi package is available. You should update to version 0.8-r14 to mitigate the vulnerability.
Yes, you can use the Vulert playground to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for avahi.
