Infinite loop in Avahi - CVE-2021-3468

Vulnerability identifier: #VU79113

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3468

CWE-ID: CWE-835

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work() function. A local user can consume all available system resources and cause denial of service conditions.

Avahi
Oracle Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Workstation Extension
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Module for Basesystem
openEuler
Red Hat OpenShift Serverless
Migration Toolkit for Runtimes
Cryostat
OpenShift Logging
Red Hat Migration Toolkit for Applications
Migration Toolkit for Containers
Red Hat Single Sign-On
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
SUSE Linux Enterprise Module for Packagehub Subpackages
avahi-daemon (Ubuntu package)
libavahi-core7 (Ubuntu package)
libavahi-glib1-32bit
libavahi-gobject0-debuginfo
libavahi-gobject0
avahi-glib2-debugsource
libavahi-glib1-debuginfo
libdns_sd
libdns_sd-debuginfo
avahi-debuginfo-32bit
libavahi-client3-32bit
libavahi-client3-debuginfo-32bit
libavahi-common3-32bit
libavahi-common3-debuginfo-32bit
libavahi-ui-gtk3-0-debuginfo
libavahi-glib1-debuginfo-32bit
libdns_sd-32bit
libdns_sd-debuginfo-32bit
avahi-lang
avahi
avahi-debuginfo
avahi-debugsource
avahi-utils
avahi-utils-debuginfo
libavahi-client3
libhowl0-debuginfo
libavahi-glib1
libavahi-core7-debuginfo
libavahi-core7
libavahi-common3-debuginfo
libavahi-common3
libavahi-client3-debuginfo
typelib-1_0-Avahi-0_6
python-avahi
libavahi-ui-gtk3-0
libhowl0
libavahi-gobject-devel
libavahi-glib-devel
libavahi-devel
avahi-compat-mDNSResponder-devel
avahi-compat-howl-devel
libavahi-ui0-debuginfo
libavahi-ui0
avahi-utils-gtk-debuginfo
avahi-utils-gtk
avahi-autoipd-debuginfo
avahi-autoipd
libavahi-common3-32bit-debuginfo
python3-avahi
avahi-32bit-debuginfo
libavahi-client3-32bit-debuginfo
avahi (Red Hat package)
avahi-doc
avahi-ui-gtk3
avahi-ui-devel
avahi-ui
avahi-libs
avahi-gobject-devel
avahi-gobject
avahi-glib-devel
avahi-glib
avahi-devel
avahi-compat-libdns_sd-devel
avahi-compat-libdns_sd
avahi-compat-howl
avahi-dnsconfd
avahi-tools
avahi-help
avahi-ui-tools
avahi-qt5-devel
avahi-qt5
IBM Cloud Pak for Watson AIOps
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

Install updates from vendor's website.

Avahi - update to 0.9 rc1
Red Hat OpenShift Serverless - addressed in versions 1.31.1, 1.32.0
Migration Toolkit for Runtimes - addressed in versions 1.2.4, 1.2.5
Migration Toolkit for Containers - addressed in versions 1.7.15, 1.8.3
OpenShift Logging - update to 5.8.1
Red Hat Single Sign-On - update to 7.6.6
avahi-daemon (Ubuntu package) - addressed in versions 0.6.32~rc+dfsg1ubuntu2.3+esm1, 0.7-3.1ubuntu1.3, 0.7-4ubuntu7.1, 0.8-3ubuntu1.1, 0.8-5ubuntu3.1
libavahi-core7 (Ubuntu package) - addressed in versions 0.6.32~rc+dfsg1ubuntu2.3+esm1, 0.7-3.1ubuntu1.3, 0.7-4ubuntu7.1, 0.8-3ubuntu1.1, 0.8-5ubuntu3.1
libavahi-glib1-32bit - update to 0.6.32-32.15.1
libavahi-gobject0-debuginfo - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-gobject0 - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
avahi-glib2-debugsource - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-glib1-debuginfo - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libdns_sd - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libdns_sd-debuginfo - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
avahi-debuginfo-32bit - update to 0.6.32-32.15.1
libavahi-client3-32bit - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-client3-debuginfo-32bit - update to 0.6.32-32.15.1
libavahi-common3-32bit - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-common3-debuginfo-32bit - update to 0.6.32-32.15.1
libavahi-ui-gtk3-0-debuginfo - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-glib1-debuginfo-32bit - update to 0.6.32-32.15.1
libdns_sd-32bit - update to 0.6.32-32.15.1
libdns_sd-debuginfo-32bit - update to 0.6.32-32.15.1
avahi-lang - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
avahi - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
avahi-debuginfo - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
avahi-debugsource - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
avahi-utils - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
avahi-utils-debuginfo - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-client3 - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libhowl0-debuginfo - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-glib1 - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-core7-debuginfo - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-core7 - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-common3-debuginfo - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-common3 - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-client3-debuginfo - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
typelib-1_0-Avahi-0_6 - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
python-avahi - update to 0.6.32-32.15.1
libavahi-ui-gtk3-0 - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libhowl0 - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-gobject-devel - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-glib-devel - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-devel - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
avahi-compat-mDNSResponder-devel - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
avahi-compat-howl-devel - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-ui0-debuginfo - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
libavahi-ui0 - addressed in versions 0.6.32-32.15.1, 0.7-3.9.1
avahi-utils-gtk-debuginfo - update to 0.7-3.9.1
avahi-utils-gtk - update to 0.7-3.9.1
avahi-autoipd-debuginfo - update to 0.7-3.9.1
avahi-autoipd - update to 0.7-3.9.1
libavahi-common3-32bit-debuginfo - update to 0.7-3.9.1
python3-avahi - update to 0.7-3.9.1
avahi-32bit-debuginfo - update to 0.7-3.9.1
libavahi-client3-32bit-debuginfo - update to 0.7-3.9.1
avahi (Red Hat package) - addressed in versions 0.7-20.el8_6.3, 0.7-20.el8_8.4, 0.7-21.el8_9.1, 0.8-15.el9
avahi-doc - update to 0.7-21.0.1
python3-avahi - addressed in versions 0.7-21.0.1, 0.8-6
avahi-ui-gtk3 - addressed in versions 0.7-21.0.1, 0.8-6
avahi-ui-devel - addressed in versions 0.7-21.0.1, 0.8-6
avahi-ui - update to 0.7-21.0.1
avahi-libs - addressed in versions 0.7-21.0.1, 0.8-6
avahi-gobject-devel - addressed in versions 0.7-21.0.1, 0.8-6
avahi-gobject - addressed in versions 0.7-21.0.1, 0.8-6
avahi-glib-devel - addressed in versions 0.7-21.0.1, 0.8-6
avahi-glib - addressed in versions 0.7-21.0.1, 0.8-6
avahi-devel - addressed in versions 0.7-21.0.1, 0.8-6
avahi-compat-libdns_sd-devel - addressed in versions 0.7-21.0.1, 0.8-6
avahi-compat-libdns_sd - addressed in versions 0.7-21.0.1, 0.8-6
avahi-compat-howl-devel - addressed in versions 0.7-21.0.1, 0.8-6
avahi-compat-howl - addressed in versions 0.7-21.0.1, 0.8-6
avahi-autoipd - addressed in versions 0.7-21.0.1, 0.8-6
avahi - addressed in versions 0.7-21.0.1, 0.8-6
avahi - update to 0.8-4
avahi-compat-howl-devel - update to 0.8-4
avahi-ui-devel - update to 0.8-4
avahi-glib - update to 0.8-4
avahi-compat-libdns_sd-devel - update to 0.8-4
avahi-compat-libdns_sd - update to 0.8-4
avahi-ui-gtk3 - update to 0.8-4
avahi-devel - update to 0.8-4
avahi-debuginfo - update to 0.8-4
avahi-compat-howl - update to 0.8-4
avahi-debugsource - update to 0.8-4
avahi-dnsconfd - update to 0.8-4
avahi-tools - update to 0.8-4
avahi-help - update to 0.8-4
avahi-ui - update to 0.8-4
avahi-libs - update to 0.8-4
avahi-gobject - update to 0.8-4
avahi-ui-tools - update to 0.8-6
avahi-tools - update to 0.8-6
avahi-qt5-devel - update to 0.8-6
avahi-qt5 - update to 0.8-6
avahi-dnsconfd - update to 0.8-6
IBM Cloud Pak for Watson AIOps - update to 4.4.0
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity Operating Environment (OE) - update to 5.2.0.0.5.173
Red Hat Migration Toolkit for Applications - update to 6.2

• https://bugzilla.redhat.com/show_bug.cgi?id=1939614
• https://lists.debian.org/debian-lts-announce/2022/06/msg00009.html
• https://lists.debian.org/debian-lts-announce/2023/06/msg00028.html
• https://github.com/avahi/avahi/security/advisories/GHSA-mrwc-c54v-3rg8

• Multiple vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 9 update for avahi
• Red Hat Enterprise Linux 8 update for avahi
• Multiple vulnerabilities in Logging Subsystem 5.8 for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Red Hat Enterprise Linux 8.6 Extended Update Support update for avahi
• Multiple vulnerabilities in Red Hat build of Cryostat 2 on RHEL 8
• Red Hat Enterprise Linux 8.8 Extended Update Support update for avahi
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• openEuler 20.03 LTS SP1 update for avahi
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.8
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.7
• SUSE update for avahi
• SUSE update for avahi
• SUSE update for avahi
• SUSE update for avahi
• Ubuntu update for avahi
• Ubuntu update for avahi
• Anolis OS update for avahi
• Anolis OS update for avahi
• Local denial of service in Avahi