Skip to content

Commit 132e58d

Browse files
azurelinux-securityKanishk-Bansal
azurelinux-security
and
Kanishk-Bansal
authored
[AutoPR- Security] Patch avahi for CVE-2026-34933 [MEDIUM] (#16541)
Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
1 parent 607eba4 commit 132e58d

2 files changed

Lines changed: 217 additions & 1 deletion

File tree

‎SPECS/avahi/CVE-2026-34933.patch‎

Lines changed: 212 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
1+
From 2a057c4f76cadc9c71846e076c9e1d3cd39c3e84 Mon Sep 17 00:00:00 2001
2+
From: Evgeny Vereshchagin <evvers@ya.ru>
3+
Date: Wed, 1 Apr 2026 05:31:58 +0000
4+
Subject: [PATCH 1/3] core: refuse to accept publish flags where both wide_area
5+
and multicast are set
6+
7+
It fixes a bug where it was possible for unprivileged local users to
8+
crash avahi-daemon via D-Bus by calling EntryGroup methods accepting
9+
flags and passing both AVAHI_PUBLISH_USE_WIDE_AREA and
10+
AVAHI_PUBLISH_USE_MULTICAST there. For example when AddRecord was
11+
invoked like that avahi-daemon crashed with
12+
```
13+
dbus-entry-group.c: interface=org.freedesktop.Avahi.EntryGroup, path=/Client0/EntryGroup1, member=AddRecord
14+
avahi-daemon: entry.c:57: transport_flags_from_domain: Assertion `!((*flags & AVAHI_PUBLISH_USE_MULTICAST) && (*flags & AVAHI_PUBLISH_USE_WIDE_AREA))' failed.
15+
==84944==
16+
==84944== Process terminating with default action of signal 6 (SIGABRT)
17+
==84944== at 0x4B353BC: __pthread_kill_implementation (pthread_kill.c:44)
18+
==84944== by 0x4ADE941: raise (raise.c:26)
19+
==84944== by 0x4AC64AB: abort (abort.c:77)
20+
==84944== by 0x4AC641F: __assert_fail_base.cold (assert.c:118)
21+
==84944== by 0x48A9404: transport_flags_from_domain (entry.c:57)
22+
==84944== by 0x48A9F8F: server_add_internal (entry.c:224)
23+
==84944== by 0x48AA49F: avahi_server_add (entry.c:324)
24+
==84944== by 0x401A670: avahi_dbus_msg_entry_group_impl (dbus-entry-group.c:348)
25+
==84944== by 0x4A70741: ??? (in /usr/lib/x86_64-linux-gnu/libdbus-1.so.3.38.3)
26+
==84944== by 0x4A5FB22: dbus_connection_dispatch (in /usr/lib/x86_64-linux-gnu/libdbus-1.so.3.38.3)
27+
==84944== by 0x401D01D: dispatch_timeout_callback (dbus-watch-glue.c:105)
28+
==84944== by 0x488E3AE: timeout_callback (simple-watch.c:447)
29+
==84944==
30+
```
31+
It's a follow-up to fbce111b069aa1e4c701ed37ee1d9f6d6cefaac5 where
32+
those flags were introduced and consistent with the other places
33+
where wide_area/multicast flags are used.
34+
35+
It was discovered by
36+
Guillaume Meunier - Head of Vulnerability Operations Center France - Orange Cyberdefense
37+
38+
https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc
39+
40+
CVE-2026-34933
41+
42+
Upstream-reference: https://patch-diff.githubusercontent.com/raw/avahi/avahi/pull/891.patch
43+
---
44+
avahi-core/entry.c | 7 +++++++
45+
1 file changed, 7 insertions(+)
46+
47+
diff --git a/avahi-core/entry.c b/avahi-core/entry.c
48+
index 0d86213..06eb120 100644
49+
--- a/avahi-core/entry.c
50+
+++ b/avahi-core/entry.c
51+
@@ -207,6 +207,7 @@ static AvahiEntry * server_add_internal(
52+
AVAHI_PUBLISH_UPDATE|
53+
AVAHI_PUBLISH_USE_WIDE_AREA|
54+
AVAHI_PUBLISH_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
55+
+ AVAHI_CHECK_VALIDITY_RETURN_NULL(s, !(flags & AVAHI_PUBLISH_USE_WIDE_AREA) || !(flags & AVAHI_PUBLISH_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
56+
AVAHI_CHECK_VALIDITY_RETURN_NULL(s, avahi_is_valid_domain_name(r->key->name), AVAHI_ERR_INVALID_HOST_NAME);
57+
AVAHI_CHECK_VALIDITY_RETURN_NULL(s, r->ttl != 0, AVAHI_ERR_INVALID_TTL);
58+
AVAHI_CHECK_VALIDITY_RETURN_NULL(s, !avahi_key_is_pattern(r->key), AVAHI_ERR_IS_PATTERN);
59+
@@ -454,6 +455,7 @@ int avahi_server_add_address(
60+
AVAHI_PUBLISH_UPDATE|
61+
AVAHI_PUBLISH_USE_WIDE_AREA|
62+
AVAHI_PUBLISH_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
63+
+ AVAHI_CHECK_VALIDITY(s, !(flags & AVAHI_PUBLISH_USE_WIDE_AREA) || !(flags & AVAHI_PUBLISH_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
64+
AVAHI_CHECK_VALIDITY(s, !name || avahi_is_valid_fqdn(name), AVAHI_ERR_INVALID_HOST_NAME);
65+
66+
/* Prepare the host naem */
67+
@@ -595,6 +597,7 @@ static int server_add_service_strlst_nocopy(
68+
AVAHI_PUBLISH_UPDATE|
69+
AVAHI_PUBLISH_USE_WIDE_AREA|
70+
AVAHI_PUBLISH_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
71+
+ AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, !(flags & AVAHI_PUBLISH_USE_WIDE_AREA) || !(flags & AVAHI_PUBLISH_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
72+
AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, avahi_is_valid_service_name(name), AVAHI_ERR_INVALID_SERVICE_NAME);
73+
AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, avahi_is_valid_service_type_strict(type), AVAHI_ERR_INVALID_SERVICE_TYPE);
74+
AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, !domain || avahi_is_valid_domain_name(domain), AVAHI_ERR_INVALID_DOMAIN_NAME);
75+
@@ -754,6 +757,7 @@ static int server_update_service_txt_strlst_nocopy(
76+
AVAHI_PUBLISH_NO_COOKIE|
77+
AVAHI_PUBLISH_USE_WIDE_AREA|
78+
AVAHI_PUBLISH_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
79+
+ AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, !(flags & AVAHI_PUBLISH_USE_WIDE_AREA) || !(flags & AVAHI_PUBLISH_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
80+
AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, avahi_is_valid_service_name(name), AVAHI_ERR_INVALID_SERVICE_NAME);
81+
AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, avahi_is_valid_service_type_strict(type), AVAHI_ERR_INVALID_SERVICE_TYPE);
82+
AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, !domain || avahi_is_valid_domain_name(domain), AVAHI_ERR_INVALID_DOMAIN_NAME);
83+
@@ -843,6 +847,7 @@ int avahi_server_add_service_subtype(
84+
AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, AVAHI_IF_VALID(interface), AVAHI_ERR_INVALID_INTERFACE);
85+
AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, AVAHI_PROTO_VALID(protocol), AVAHI_ERR_INVALID_PROTOCOL);
86+
AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, AVAHI_FLAGS_VALID(flags, AVAHI_PUBLISH_USE_MULTICAST|AVAHI_PUBLISH_USE_WIDE_AREA), AVAHI_ERR_INVALID_FLAGS);
87+
+ AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, !(flags & AVAHI_PUBLISH_USE_WIDE_AREA) || !(flags & AVAHI_PUBLISH_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
88+
AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, avahi_is_valid_service_name(name), AVAHI_ERR_INVALID_SERVICE_NAME);
89+
AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, avahi_is_valid_service_type_strict(type), AVAHI_ERR_INVALID_SERVICE_TYPE);
90+
AVAHI_CHECK_VALIDITY_SET_RET_GOTO_FAIL(s, !domain || avahi_is_valid_domain_name(domain), AVAHI_ERR_INVALID_DOMAIN_NAME);
91+
@@ -910,6 +915,7 @@ static AvahiEntry *server_add_dns_server_name(
92+
assert(name);
93+
94+
AVAHI_CHECK_VALIDITY_RETURN_NULL(s, AVAHI_FLAGS_VALID(flags, AVAHI_PUBLISH_USE_WIDE_AREA|AVAHI_PUBLISH_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
95+
+ AVAHI_CHECK_VALIDITY_RETURN_NULL(s, !(flags & AVAHI_PUBLISH_USE_WIDE_AREA) || !(flags & AVAHI_PUBLISH_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
96+
AVAHI_CHECK_VALIDITY_RETURN_NULL(s, type == AVAHI_DNS_SERVER_UPDATE || type == AVAHI_DNS_SERVER_RESOLVE, AVAHI_ERR_INVALID_FLAGS);
97+
AVAHI_CHECK_VALIDITY_RETURN_NULL(s, port != 0, AVAHI_ERR_INVALID_PORT);
98+
AVAHI_CHECK_VALIDITY_RETURN_NULL(s, avahi_is_valid_fqdn(name), AVAHI_ERR_INVALID_HOST_NAME);
99+
@@ -967,6 +973,7 @@ int avahi_server_add_dns_server_address(
100+
AVAHI_CHECK_VALIDITY(s, AVAHI_IF_VALID(interface), AVAHI_ERR_INVALID_INTERFACE);
101+
AVAHI_CHECK_VALIDITY(s, AVAHI_PROTO_VALID(protocol) && AVAHI_PROTO_VALID(address->proto), AVAHI_ERR_INVALID_PROTOCOL);
102+
AVAHI_CHECK_VALIDITY(s, AVAHI_FLAGS_VALID(flags, AVAHI_PUBLISH_USE_MULTICAST|AVAHI_PUBLISH_USE_WIDE_AREA), AVAHI_ERR_INVALID_FLAGS);
103+
+ AVAHI_CHECK_VALIDITY(s, !(flags & AVAHI_PUBLISH_USE_WIDE_AREA) || !(flags & AVAHI_PUBLISH_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
104+
AVAHI_CHECK_VALIDITY(s, type == AVAHI_DNS_SERVER_UPDATE || type == AVAHI_DNS_SERVER_RESOLVE, AVAHI_ERR_INVALID_FLAGS);
105+
AVAHI_CHECK_VALIDITY(s, port != 0, AVAHI_ERR_INVALID_PORT);
106+
AVAHI_CHECK_VALIDITY(s, !domain || avahi_is_valid_domain_name(domain), AVAHI_ERR_INVALID_DOMAIN_NAME);
107+
--
108+
2.45.4
109+
110+
111+
From 473a2d654eef0feb5e66f5ca35a53c76d072d7fc Mon Sep 17 00:00:00 2001
112+
From: Evgeny Vereshchagin <evvers@ya.ru>
113+
Date: Wed, 1 Apr 2026 05:30:58 +0000
114+
Subject: [PATCH 2/3] tests: make sure AVAHI_PUBLISH_USE_WIDE_AREA is refused
115+
116+
---
117+
avahi-client/client-test.c | 25 +++++++++++++++++++++++++
118+
avahi-core/avahi-test.c | 12 +++++++++++-
119+
2 files changed, 36 insertions(+), 1 deletion(-)
120+
121+
diff --git a/avahi-client/client-test.c b/avahi-client/client-test.c
122+
index 57750a4..42f5b70 100644
123+
--- a/avahi-client/client-test.c
124+
+++ b/avahi-client/client-test.c
125+
@@ -209,6 +209,28 @@ static void terminate(AVAHI_GCC_UNUSED AvahiTimeout *timeout, AVAHI_GCC_UNUSED v
126+
avahi_simple_poll_quit(simple_poll);
127+
}
128+
129+
+static void test_refuse_publish_flags(AvahiEntryGroup *g, AvahiPublishFlags flags, int expected) {
130+
+ AvahiAddress a;
131+
+ AvahiStringList *l = NULL;
132+
+ int r;
133+
+
134+
+ r = avahi_entry_group_add_record(g, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, flags, "test.local", AVAHI_DNS_CLASS_IN, AVAHI_DNS_TYPE_CNAME, 120, "\0", 1);
135+
+ assert(r == expected);
136+
+
137+
+ avahi_address_parse("224.0.0.251", AVAHI_PROTO_UNSPEC, &a);
138+
+ r = avahi_entry_group_add_address(g, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, flags, "test.local", &a);
139+
+ assert(r == expected);
140+
+
141+
+ r = avahi_entry_group_add_service_strlst(g, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, flags, "test", "_http._tcp", NULL, NULL, 80, l);
142+
+ assert(r == expected);
143+
+
144+
+ r = avahi_entry_group_update_service_txt_strlst(g, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, flags, "test", "_http._tcp", NULL, l);
145+
+ assert(r == expected);
146+
+
147+
+ r = avahi_entry_group_add_service_subtype(g, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, flags, "test", "_http._tcp", NULL, "_magic._sub._http._tcp");
148+
+ assert(r == expected);
149+
+}
150+
+
151+
int main (AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char *argv[]) {
152+
AvahiClient *avahi;
153+
AvahiEntryGroup *group, *group2;
154+
@@ -261,6 +283,9 @@ int main (AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char *argv[]) {
155+
error = avahi_entry_group_add_record (group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, "TestX", 0x01, 0x10, 120, "", 0);
156+
assert(error != AVAHI_OK);
157+
158+
+ test_refuse_publish_flags(group, AVAHI_PUBLISH_USE_WIDE_AREA, AVAHI_ERR_NOT_SUPPORTED);
159+
+ test_refuse_publish_flags(group, AVAHI_PUBLISH_USE_WIDE_AREA|AVAHI_PUBLISH_USE_MULTICAST, AVAHI_ERR_INVALID_FLAGS);
160+
+
161+
avahi_entry_group_commit (group);
162+
163+
domain = avahi_domain_browser_new (avahi, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, NULL, AVAHI_DOMAIN_BROWSER_BROWSE, 0, avahi_domain_browser_callback, (char*) "omghai3u");
164+
diff --git a/avahi-core/avahi-test.c b/avahi-core/avahi-test.c
165+
index 2a7872b..2bae82b 100644
166+
--- a/avahi-core/avahi-test.c
167+
+++ b/avahi-core/avahi-test.c
168+
@@ -30,6 +30,7 @@
169+
#include <netinet/in.h>
170+
#include <arpa/inet.h>
171+
172+
+#include <avahi-common/error.h>
173+
#include <avahi-common/malloc.h>
174+
#include <avahi-common/simple-watch.h>
175+
#include <avahi-common/alternative.h>
176+
@@ -150,6 +151,7 @@ static void remove_entries(void) {
177+
static void create_entries(int new_name) {
178+
AvahiAddress a;
179+
AvahiRecord *r;
180+
+ int error;
181+
182+
remove_entries();
183+
184+
@@ -181,7 +183,15 @@ static void create_entries(int new_name) {
185+
goto fail;
186+
}
187+
188+
- if (avahi_server_add_dns_server_address(server, group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, NULL, AVAHI_DNS_SERVER_RESOLVE, avahi_address_parse("192.168.50.1", AVAHI_PROTO_UNSPEC, &a), 53) < 0) {
189+
+ avahi_address_parse("192.168.50.1", AVAHI_PROTO_UNSPEC, &a);
190+
+
191+
+ error = avahi_server_add_dns_server_address(server, group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, AVAHI_PUBLISH_USE_WIDE_AREA, NULL, AVAHI_DNS_SERVER_RESOLVE, &a, 53);
192+
+ assert(error == AVAHI_ERR_NOT_SUPPORTED);
193+
+
194+
+ error = avahi_server_add_dns_server_address(server, group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, AVAHI_PUBLISH_USE_WIDE_AREA|AVAHI_PUBLISH_USE_MULTICAST, NULL, AVAHI_DNS_SERVER_RESOLVE, &a, 53);
195+
+ assert(error == AVAHI_ERR_INVALID_FLAGS);
196+
+
197+
+ if (avahi_server_add_dns_server_address(server, group, AVAHI_IF_UNSPEC, AVAHI_PROTO_UNSPEC, 0, NULL, AVAHI_DNS_SERVER_RESOLVE, &a, 53) < 0) {
198+
avahi_log_error("Failed to add new DNS Server address");
199+
goto fail;
200+
}
201+
--
202+
2.45.4
203+
204+
205+
From a3acf8c22e723952204ff5b654ff9fa436cc9775 Mon Sep 17 00:00:00 2001
206+
From: Evgeny Vereshchagin <evvers@ya.ru>
207+
Date: Wed, 1 Apr 2026 12:18:33 +0000
208+
Subject: [PATCH 3/3] build: bump
209+
210+
--
211+
2.45.4
212+

‎SPECS/avahi/avahi.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Summary: Local network service discovery
44
Name: avahi
55
Version: 0.8
6-
Release: 5%{?dist}
6+
Release: 6%{?dist}
77
License: LGPLv2+
88
Vendor: Microsoft Corporation
99
Distribution: Mariner
@@ -23,6 +23,7 @@ Patch10: CVE-2025-68276.patch
2323
Patch11: CVE-2025-68468.patch
2424
Patch12: CVE-2025-68471.patch
2525
Patch13: CVE-2026-24401.patch
26+
Patch14: CVE-2026-34933.patch
2627
BuildRequires: automake
2728
BuildRequires: dbus-devel >= 0.90
2829
BuildRequires: dbus-glib-devel >= 0.70
@@ -430,6 +431,9 @@ exit 0
430431
%endif
431432

432433
%changelog
434+
* Thu Apr 09 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 0.8-6
435+
- Patch for CVE-2026-34933
436+
433437
* Tue Jan 27 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 0.8-5
434438
- Patch for CVE-2026-24401, CVE-2025-68471, CVE-2025-68468, CVE-2025-68276
435439

0 commit comments

Comments
 (0)