CVE-2025-68468: Avahi Daemon DoS Vulnerability

CVE-2025-68468 Overview

CVE-2025-68468 is a Denial of Service vulnerability affecting Avahi, the popular open-source system that facilitates service discovery on local networks via the mDNS/DNS-SD protocol suite. The vulnerability allows attackers to crash the avahi-daemon by sending specially crafted unsolicited announcements containing CNAME resource records that point to other resource records with short TTLs. When these TTLs expire, an assertion failure causes the daemon to crash, disrupting network service discovery capabilities.

Critical Impact

Remote attackers on the local network can crash avahi-daemon, disrupting mDNS/DNS-SD service discovery for all network clients relying on Avahi for device and service discovery.

Affected Products

• Avahi 0.9-rc2 and earlier versions
• Linux distributions shipping vulnerable Avahi packages
• Systems utilizing mDNS/DNS-SD for local network service discovery

Discovery Timeline

• 2026-01-12 - CVE-2025-68468 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-68468

Vulnerability Analysis

This vulnerability stems from an incorrect assertion in the Avahi core browsing functionality. The CWE-617 classification indicates a "Reachable Assertion" vulnerability, where an assertion statement can be triggered by attacker-controlled input, causing the application to terminate abnormally.

The attack exploits the CNAME record handling mechanism in avahi-daemon. When the daemon receives unsolicited mDNS announcements containing CNAME records that reference other records with very short TTL values, it follows the CNAME chain. Once the referenced records' TTLs expire, the daemon attempts to process a callback for a key that no longer matches the expected lookup key, triggering an assertion failure that terminates the process.

Root Cause

The root cause is an overly strict assertion check in avahi-core/browse.c that assumed the callback key would always match the lookup key. This assumption fails when processing CNAME record chains where the original record has expired. The assertion assert(avahi_key_equal(b->key, l->key)) was triggered inappropriately during normal CNAME resolution scenarios involving expired TTLs, causing the daemon to crash rather than handle the edge case gracefully.

Attack Vector

The attack is network-accessible and can be executed by any device on the local network segment. An attacker can craft and send unsolicited mDNS announcements containing:

1. A CNAME resource record pointing to a target record
2. The target record configured with an extremely short TTL (e.g., 1 second)

When the TTL expires and Avahi attempts to invoke the user callback for the expired record, the assertion check fails, crashing the daemon. This attack requires no authentication or user interaction, making it straightforward to execute against any vulnerable Avahi installation on the same network.

The security patch removes the incorrect assertion that was causing the crash:

                 lookup_drop_cname(l, interface, protocol, 0, r);
             else {
                 /* It's a normal record, so let's call the user callback */
-                assert(avahi_key_equal(b->key, l->key));
 
                 b->callback(b, interface, protocol, event, r, flags, b->userdata);
             }

Source: GitHub Commit

Detection Methods for CVE-2025-68468

Indicators of Compromise

• Unexpected avahi-daemon process crashes or restarts in system logs
• Core dumps containing assertion failure messages from avahi-core/browse.c
• Unusual mDNS traffic patterns showing CNAME records with very short TTL values
• Service discovery failures reported by applications relying on Avahi

Detection Strategies

• Monitor for mDNS announcements containing CNAME records with TTLs under 5 seconds
• Set up process monitoring to alert on repeated avahi-daemon crashes
• Review system logs for assertion failure messages mentioning avahi_key_equal
• Implement network-level monitoring for anomalous mDNS/DNS-SD traffic patterns

Monitoring Recommendations

• Configure systemd or init system to log and alert on avahi-daemon service failures
• Deploy network intrusion detection rules for suspicious mDNS traffic patterns
• Enable core dump collection to facilitate forensic analysis of crashes
• Monitor Avahi-dependent services for connectivity issues that may indicate exploitation

How to Mitigate CVE-2025-68468

Immediate Actions Required

• Update Avahi to a patched version containing commit f66be13d7f31a3ef806d226bf8b67240179d309a
• Review and apply available security updates from your Linux distribution
• Consider temporarily disabling Avahi if service discovery is not critical to operations
• Implement network segmentation to limit exposure to untrusted devices

Patch Information

The vulnerability has been addressed in the Avahi project. The fix removes the incorrect assertion that caused the crash, allowing the daemon to properly handle CNAME records with expired TTLs. For complete technical details, refer to the GitHub Security Advisory. The patch commit is available at the Avahi GitHub repository.

Workarounds

• Disable avahi-daemon if mDNS/DNS-SD service discovery is not required for operations
• Restrict mDNS traffic using firewall rules to trusted network segments only
• Configure process supervisors to automatically restart avahi-daemon after crashes
• Deploy network access control to limit which devices can send mDNS announcements

# Disable avahi-daemon if not needed
sudo systemctl stop avahi-daemon
sudo systemctl disable avahi-daemon

# Alternatively, restrict mDNS traffic to specific interfaces
# Edit /etc/avahi/avahi-daemon.conf
# [server]
# allow-interfaces=eth0