CVE-2024-52615: Avahi-daemon DNS Response Vulnerability

CVE-2024-52615 Overview

A vulnerability in Avahi-daemon allows attackers to more easily inject malicious DNS responses. The daemon uses fixed source ports for wide-area Domain Name System (DNS) queries instead of randomizing them. This predictable behavior weakens a key defense against off-path DNS spoofing attacks. The flaw is tracked under CWE-330: Use of Insufficiently Random Values. Avahi is a common zero-configuration networking implementation shipped in Fedora, Red Hat Enterprise Linux, and many other Linux distributions. Successful exploitation can lead to cache poisoning and integrity impact on name resolution consumers.

Critical Impact
Attackers with network positioning can forge DNS responses accepted by Avahi-daemon, poisoning resolution results for local mDNS/DNS-SD consumers.

Affected Products

Avahi (upstream project)
Red Hat Enterprise Linux distributions shipping Avahi
Linux distributions bundling Avahi-daemon for mDNS/DNS-SD

Discovery Timeline

2024-11-21 - CVE-2024-52615 published to the National Vulnerability Database
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2024-52615

Vulnerability Analysis

Avahi-daemon issues wide-area DNS queries using a fixed, predictable source port. Modern DNS resolvers randomize source ports so an off-path attacker must guess a 16-bit port value in addition to the 16-bit transaction ID. Removing port randomization reduces the guesswork required to forge a valid response.

An attacker who can send spoofed UDP packets toward the host can flood responses that match the expected 5-tuple. If a forged response arrives before the legitimate one and matches the transaction ID, Avahi accepts the attacker-controlled record. Consumers that rely on Avahi resolution then act on poisoned data.

The impact is scoped to integrity of DNS responses handled by Avahi, without direct confidentiality or availability loss on the daemon itself.

Root Cause

The root cause is the use of a fixed source port for outbound wide-area DNS queries in the Avahi codebase. This design decision removes the entropy that source port randomization provides against blind spoofing, as described in RFC 5452. The upstream fix is tracked in Avahi Pull Request #577.

Attack Vector

Exploitation requires the ability to inject UDP packets toward the victim host on the network path or from an off-path position via response flooding. No authentication or user interaction is required. The attacker crafts DNS responses matching the known source port and guesses or observes the transaction ID to inject records. See Red Hat CVE Details for CVE-2024-52615 for vendor analysis.

No public proof-of-concept exploit code has been published for this issue.

Detection Methods for CVE-2024-52615

Indicators of Compromise

Unexpected DNS resolution results from services relying on Avahi for name resolution
High volumes of inbound UDP packets sourced from port 53 targeting the Avahi query port
Duplicate or conflicting DNS responses arriving for the same transaction ID

Detection Strategies

Capture Avahi-daemon outbound query traffic and verify whether source ports remain static across queries
Correlate Avahi query logs with authoritative DNS resolver logs to identify divergent responses
Alert on repeated DNS transaction ID collisions or malformed responses on the Avahi client port

Monitoring Recommendations

Monitor network telemetry for unsolicited UDP/53 traffic directed at hosts running Avahi-daemon
Track version inventory of the avahi package across Linux endpoints to identify unpatched systems
Log and review changes to /etc/avahi/avahi-daemon.conf and any enable-wide-area settings

How to Mitigate CVE-2024-52615

Immediate Actions Required

Apply distribution updates for Avahi as soon as they are available from your vendor
Disable wide-area DNS resolution in Avahi where mDNS-only operation is acceptable
Restrict Avahi-daemon exposure to trusted network segments using host and network firewalls

Patch Information

Red Hat has issued fixes referenced in RHSA-2025:11402 and RHSA-2025:16441. The upstream source-port randomization fix is available in Avahi Pull Request #577. Additional tracking is available in Red Hat Bugzilla #2326418.

Workarounds

Set enable-wide-area=no in /etc/avahi/avahi-daemon.conf if wide-area DNS-SD is not required
Block inbound UDP/53 traffic to hosts running Avahi-daemon at the perimeter and host firewall
Prefer a hardened caching resolver such as systemd-resolved or unbound for name resolution instead of Avahi wide-area queries

bash

# Configuration example: disable wide-area DNS resolution in Avahi
sudo sed -i 's/^#\?enable-wide-area=.*/enable-wide-area=no/' /etc/avahi/avahi-daemon.conf
sudo systemctl restart avahi-daemon