CVE-2025-68276: Avahi mDNS/DNS-SD DoS Vulnerability

CVE-2025-68276 Overview

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. A local denial of service vulnerability exists in Avahi versions 0.9-rc2 and earlier that allows unprivileged local users to crash the avahi-daemon process. This occurs when wide-area DNS-SD is disabled, yet attackers can create record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via the D-Bus interface.

Critical Impact

Unprivileged local users can crash the avahi-daemon service, disrupting mDNS/DNS-SD service discovery functionality across the local network.

Affected Products

• Avahi versions 0.9-rc2 and earlier
• Systems running avahi-daemon with wide-area DNS-SD disabled
• Linux distributions utilizing Avahi for network service discovery

Discovery Timeline

• 2026-01-12 - CVE CVE-2025-68276 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-68276

Vulnerability Analysis

This vulnerability is classified as CWE-617 (Reachable Assertion), a condition where an assertion can be triggered by external input, leading to an application crash. The flaw exists in the D-Bus interface handling of the Avahi daemon when processing record browser creation requests.

When avahi-daemon is configured with wide-area DNS-SD disabled (a common configuration), the daemon does not properly validate the AVAHI_LOOKUP_USE_WIDE_AREA flag passed through D-Bus method calls. An unprivileged local user can invoke the RecordBrowserNew method directly or utilize higher-level APIs such as hostname, address, or service resolvers/browsers that internally create record browsers with this flag set.

The assertion failure occurs because the daemon encounters an unexpected state when wide-area functionality is requested but the subsystem is disabled, causing the process to terminate abnormally.

Root Cause

The root cause is inadequate input validation in the D-Bus interface layer. The daemon fails to check whether wide-area DNS-SD functionality is enabled before processing requests that specify the AVAHI_LOOKUP_USE_WIDE_AREA flag. This allows the daemon to enter a code path that triggers a reachable assertion, crashing the service.

Attack Vector

The attack requires local access to the system and utilizes the D-Bus inter-process communication mechanism. An attacker with an unprivileged local account can interact with the Avahi D-Bus interface using standard D-Bus tools or libraries. The exploitation can be achieved through multiple methods:

1. Directly calling the RecordBrowserNew D-Bus method with the AVAHI_LOOKUP_USE_WIDE_AREA flag
2. Creating hostname resolvers that internally instantiate record browsers with the wide-area flag
3. Creating address resolvers or service browsers that trigger the same internal behavior

The attack does not require any special privileges beyond local system access and the ability to communicate with the D-Bus session or system bus.

Detection Methods for CVE-2025-68276

Indicators of Compromise

• Unexpected avahi-daemon process crashes or service restarts
• System logs showing assertion failures from the avahi-daemon process
• D-Bus audit logs showing repeated calls to RecordBrowserNew or resolver creation methods
• Service discovery failures across the local network following daemon crashes

Detection Strategies

• Monitor system logs for avahi-daemon crash events and assertion failure messages
• Implement D-Bus auditing to track calls to Avahi interfaces, particularly RecordBrowserNew method invocations
• Configure process monitoring to detect repeated restarts of the avahi-daemon service
• Analyze D-Bus traffic patterns for anomalous wide-area flag usage when the feature is disabled

Monitoring Recommendations

• Enable enhanced logging for the avahi-daemon service to capture detailed error information
• Set up alerts for avahi-daemon service state changes, particularly unexpected terminations
• Monitor for repeated D-Bus method calls from non-standard or suspicious user contexts
• Implement crash dump collection for forensic analysis of assertion failures

How to Mitigate CVE-2025-68276

Immediate Actions Required

• Update Avahi to a patched version that addresses this vulnerability
• Review D-Bus access policies to restrict which users can interact with the Avahi service interface
• Consider temporarily disabling the Avahi service if not required for critical operations
• Monitor systems for signs of exploitation attempts

Patch Information

A fix has been committed to the Avahi repository addressing this vulnerability. The patch is available via GitHub Commit ede7048. Additional details can be found in Pull Request #806 and the GitHub Security Advisory GHSA-mhf3-865v-g5rc.

System administrators should apply the patch from their distribution's package repositories when available or compile from source using the patched commit.

Workarounds

• Restrict D-Bus access to the Avahi service by modifying D-Bus policy configuration files
• If wide-area DNS-SD is not required, ensure it remains disabled while also restricting access to the D-Bus interface
• Use D-Bus policy rules to limit which users can call Avahi methods that create record browsers
• Consider running avahi-daemon in a more restricted environment using systemd sandboxing features

# D-Bus policy restriction example (add to /etc/dbus-1/system.d/avahi-dbus.conf)
# Restrict Avahi interface access to specific users/groups
<policy user="root">
  <allow send_destination="org.freedesktop.Avahi"/>
</policy>
<policy context="default">
  <deny send_destination="org.freedesktop.Avahi"
        send_interface="org.freedesktop.Avahi.Server"
        send_member="RecordBrowserNew"/>
</policy>