CVE-2021-26720 – This vulnerability in Debian's avahi package al... (How to Fix)

📋 TL;DR

This vulnerability in Debian's avahi package allows local attackers to perform symlink attacks on files under /run/avahi-daemon. Attackers can cause denial of service or create arbitrary empty files by exploiting improper file handling in avahi-daemon-check-dns.sh. Only Debian GNU/Linux systems (and SUSE systems using Debian packages) are affected, not upstream Avahi installations.

💻 Affected Systems

Products:

Debian avahi package
SUSE Linux using Debian avahi packages

Versions: avahi package versions through 0.8-4

Operating Systems: Debian GNU/Linux, SUSE Linux (when using Debian packages)

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects Debian packaging, not upstream Avahi. Ubuntu systems may also be affected based on Launchpad bug reference.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local root privilege escalation leading to system compromise, though the vulnerability description suggests file creation/DoS is the primary impact

🟠

Likely Case

Local denial of service affecting avahi-daemon functionality or creation of empty files in system directories

🟢

If Mitigated

Minimal impact if proper file permissions and symlink protections are in place

🌐 Internet-Facing: LOW - This is a local attack requiring access to the system

🏢 Internal Only: MEDIUM - Local attackers on multi-user systems could disrupt avahi services

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires local access to the system. The symlink attack technique is well-known and easy to implement.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 0.8-4

Vendor Advisory: https://lists.debian.org/debian-lts-announce/2022/06/msg00009.html

Restart Required: Yes

Instructions:

1. Update avahi package: sudo apt update && sudo apt upgrade avahi-daemon
2. Restart avahi-daemon: sudo systemctl restart avahi-daemon
3. Verify the fix by checking version: dpkg -l | grep avahi

🔧 Temporary Workarounds

Remove vulnerable script

linux

Remove or disable the vulnerable avahi-daemon-check-dns.sh script

sudo rm /etc/network/if-up.d/avahi-daemon
sudo chmod 000 /etc/network/if-up.d/avahi-daemon

Restrict script permissions

linux

Change permissions to prevent execution

sudo chmod 644 /etc/network/if-up.d/avahi-daemon

🧯 If You Can't Patch

Implement strict file permission controls on /run/avahi-daemon directory
Monitor for symlink creation attempts in system directories

🔍 How to Verify

Check if Vulnerable:

Check avahi package version: dpkg -l | grep '^ii.*avahi' | awk '{print $3}'

Check Version:

dpkg -l | grep '^ii.*avahi' | awk '{print $3}'

Verify Fix Applied:

Verify version is newer than 0.8-4 and check if /etc/network/if-up.d/avahi-daemon exists with proper permissions

📡 Detection & Monitoring

Log Indicators:

Failed avahi-daemon startups
Permission denied errors in /run/avahi-daemon
Unexpected symlink creation in system directories

Network Indicators:

Avahi service disruptions
mDNS/DNS-SD service failures

SIEM Query:

process.name:"avahi-daemon-check-dns.sh" AND file.path:"/run/avahi-daemon/*"

📊 Metadata

CVE ID: CVE-2021-26720

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-59

Published: February 17, 2021

Last Updated: November 21, 2024

🔗 References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982796 Mailing List,Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/avahi/+bug/1870824 Issue Tracking,Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1180827 Issue Tracking,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/06/msg00009.html Mailing List,Third Party Advisory
https://metadata.ftp-master.debian.org/changelogs/main/a/avahi/avahi_0.8-4_changelog Broken Link,Third Party Advisory
https://packages.debian.org/bullseye/avahi-daemon Product,Third Party Advisory
https://packages.debian.org/buster/avahi-daemon Product,Third Party Advisory
https://packages.debian.org/sid/avahi-daemon Product,Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2021-26720 Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/02/15/2 Mailing List,Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982796 Mailing List,Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/avahi/+bug/1870824 Issue Tracking,Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1180827 Issue Tracking,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/06/msg00009.html Mailing List,Third Party Advisory
https://metadata.ftp-master.debian.org/changelogs/main/a/avahi/avahi_0.8-4_changelog Broken Link,Third Party Advisory
https://packages.debian.org/bullseye/avahi-daemon Product,Third Party Advisory
https://packages.debian.org/buster/avahi-daemon Product,Third Party Advisory
https://packages.debian.org/sid/avahi-daemon Product,Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2021-26720 Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/02/15/2 Mailing List,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-26720, you might also want to check these: