CVE-2024-52616: Avahi Daemon DNS Spoofing Vulnerability

CVE-2024-52616 Overview

CVE-2024-52616 affects the Avahi-daemon, a service that implements multicast DNS (mDNS) and DNS Service Discovery on Linux systems. The daemon initializes DNS transaction IDs randomly only once at startup, then increments them sequentially for subsequent queries. This predictable pattern enables attackers to guess transaction IDs and conduct DNS spoofing attacks against clients relying on the daemon. The flaw is tracked under CWE-334: Small Space of Random Values. Red Hat released fixes through RHSA-2025:7437, and the upstream fix landed in GitHub Pull Request #577.

Critical Impact
Predictable DNS transaction IDs allow network-adjacent attackers to forge DNS responses, redirecting name resolution to attacker-controlled destinations.

Affected Products

Avahi-daemon (upstream project)
Red Hat Enterprise Linux distributions shipping Avahi
Downstream Linux distributions that package the affected Avahi versions

Discovery Timeline

2024-11-21 - CVE-2024-52616 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2024-52616

Vulnerability Analysis

Avahi provides mDNS/DNS-SD functionality on Linux systems and issues DNS queries on behalf of local applications. Each DNS query carries a 16-bit transaction ID that clients use to match responses to outstanding requests. Transaction IDs must be unpredictable to prevent off-path attackers from injecting forged responses.

In the affected Avahi versions, the daemon seeds the transaction ID once at startup using a random value. Every subsequent query increments the ID sequentially rather than generating a fresh random value. An attacker who observes or guesses a single transaction ID can predict all future IDs issued by that daemon instance.

This behavior weakens one of the core defenses against DNS cache poisoning. When combined with source port predictability or spoofable network positions, the attacker's window to inject a matching forged response widens.

Root Cause

The root cause is insufficient entropy in transaction ID generation, classified as CWE-334: Small Space of Random Values. The daemon treats the transaction ID counter as a monotonically incrementing value rather than an independent random draw per query. See Red Hat Bug Report #2326429 for full triage details.

Attack Vector

Exploitation requires network reachability to the Avahi-daemon's DNS traffic or the ability to race responses to the daemon. The attacker predicts the next transaction ID, crafts a DNS response matching an outstanding or anticipated query, and delivers it before the legitimate resolver responds. A successful spoof integrity-impacts name resolution for consumers of the daemon without authentication or user interaction. Technical details are described in prose only; refer to GitHub Pull Request #577 for the upstream fix.

Detection Methods for CVE-2024-52616

Indicators of Compromise

Unexpected DNS responses arriving from non-authoritative sources for hostnames resolved via Avahi
Local applications resolving mDNS or DNS-SD names to unexpected IP addresses
Elevated volumes of inbound DNS response packets targeting the Avahi query source port
Sequential DNS transaction IDs visible in packet captures of Avahi query traffic

Detection Strategies

Inspect Avahi package versions across managed Linux hosts and flag any predating the RHSA-2025:7437 fix
Capture DNS traffic originating from Avahi-daemon and analyze transaction ID distribution for sequential patterns
Alert on DNS responses received without a corresponding recent query from the same host
Correlate mDNS/DNS-SD lookups with subsequent connections to unexpected external destinations

Monitoring Recommendations

Forward Avahi and system DNS logs to a centralized analytics pipeline for anomaly review
Track process-level network telemetry for avahi-daemon and its child resolutions
Monitor for spikes in DNS response traffic on hosts exposing Avahi to untrusted network segments
Baseline normal mDNS name-to-IP mappings and alert when resolutions deviate

How to Mitigate CVE-2024-52616

Immediate Actions Required

Apply vendor updates that include the upstream Avahi fix from Pull Request #577
On Red Hat systems, install the updates provided by RHSA-2025:7437
Restrict Avahi exposure to trusted network segments using host firewalls
Disable Avahi on hosts that do not require mDNS or DNS-SD functionality

Patch Information

Red Hat published the fix in RHSA-2025:7437 with additional context available on the Red Hat CVE-2024-52616 page. The upstream Avahi project merged the corrective change in Pull Request #577, which replaces sequential transaction ID incrementing with per-query random generation. Users on other distributions should track their vendor's advisory referencing this CVE.

Workarounds

Stop and mask the avahi-daemon.service unit on systems that do not require local service discovery
Block UDP port 5353 and unsolicited DNS responses at the host firewall for exposed interfaces
Segment Avahi-enabled hosts onto isolated VLANs where untrusted clients cannot inject DNS traffic
Restart the daemon on a scheduled cadence to reseed the transaction ID counter until patches are deployed

bash

# Configuration example: disable Avahi where not required
sudo systemctl stop avahi-daemon.socket avahi-daemon.service
sudo systemctl disable avahi-daemon.socket avahi-daemon.service
sudo systemctl mask avahi-daemon.service

# Restrict mDNS traffic at the host firewall (firewalld example)
sudo firewall-cmd --permanent --remove-service=mdns
sudo firewall-cmd --reload