CVE-2025-68468
📋 TL;DR
This vulnerability allows remote attackers to crash the Avahi daemon by sending malicious mDNS announcements containing CNAME records with short TTLs. When these records expire, the daemon crashes due to improper handling. Systems running Avahi 0.9-rc2 or earlier are affected.
💻 Affected Systems
- Avahi
📦 What is this software?
Avahi by Avahi
Avahi by Avahi
⚠️ Risk & Real-World Impact
Worst Case
Denial of service on the local network, disrupting service discovery and potentially affecting dependent applications that rely on Avahi for network services.
Likely Case
Avahi daemon crashes, requiring manual restart and temporarily breaking local network service discovery until restored.
If Mitigated
Minimal impact if Avahi is not running or if network filtering blocks mDNS traffic from untrusted sources.
🎯 Exploit Status
Exploit requires sending crafted mDNS packets to the target's network interface. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit f66be13d7f31a3ef806d226bf8b67240179d309a and later versions
Vendor Advisory: https://github.com/avahi/avahi/security/advisories/GHSA-cp79-r4x9-vf52
Restart Required: Yes
Instructions:
1. Update Avahi to a patched version from your distribution's repositories. 2. Restart avahi-daemon: 'sudo systemctl restart avahi-daemon' or 'sudo service avahi-daemon restart'.
🔧 Temporary Workarounds
Disable Avahi daemon
linuxStop and disable the Avahi service if not needed
sudo systemctl stop avahi-daemon
sudo systemctl disable avahi-daemon
Block mDNS traffic
linuxUse firewall rules to block mDNS (port 5353/udp) from untrusted networks
sudo iptables -A INPUT -p udp --dport 5353 -j DROP
🧯 If You Can't Patch
- Implement network segmentation to isolate Avahi services from untrusted devices
- Monitor for avahi-daemon crashes and implement automatic restart scripts
🔍 How to Verify
Check if Vulnerable:
Check Avahi version: 'avahi-daemon --version' or 'dpkg -l | grep avahi' or 'rpm -q avahi'. If version is 0.9-rc2 or earlier, system is vulnerable.Check Version:
avahi-daemon --version 2>&1 | head -1Verify Fix Applied:
Verify Avahi version is newer than 0.9-rc2 and check that avahi-daemon is running without crashes after receiving mDNS traffic.📡 Detection & Monitoring
Log Indicators:
- Avahi daemon crash logs in systemd journal: 'journalctl -u avahi-daemon'
- Segmentation fault or crash messages in /var/log/syslog
Network Indicators:
- Unusual mDNS traffic with CNAME records and short TTL values
- Multiple mDNS announcements from single source
SIEM Query:
source="avahi-daemon" AND ("segmentation fault" OR "crash" OR "SIGSEGV")