#VU79113 Infinite loop in Avahi
Vulnerability identifier: #VU79113
Vulnerability risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-835
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Avahi
Universal components / Libraries /
Libraries used by multiple products
Vendor: avahi.org
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work() function. A local user can consume all available system resources and cause denial of service conditions.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Avahi: 0.6.1 - 0.8
External links
http://bugzilla.redhat.com/show_bug.cgi?id=1939614
http://lists.debian.org/debian-lts-announce/2022/06/msg00009.html
http://lists.debian.org/debian-lts-announce/2023/06/msg00028.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
