CVE-2024-52615

A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.

Moderate impact affects Red Hat Enterprise Linux, OpenShift Container Platform, and Red Hat In-Vehicle OS where Avahi wide-area DNS is used. Avahi sends wide-area DNS queries from a constant source port, making malicious DNS response injection and DNS spoofing easier; the Red Hat CVSS is 5.3 (Moderate). The issue is limited to wide-area DNS, and .local multicast DNS (mDNS) is not affected. For OpenShift Container Platform, remediation is deferred because the exposure is limited to this specific wide-area DNS use; residual risk remains for configurations that actively use wide-area DNS. For delegated affected streams, remediation is being pursued. Community Project Fedora streams are also affected and delegated upstream.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure Avahi wide-area DNS queries to be forwarded through a local DNS resolver, such as systemd-resolved, rather than sent directly by Avahi. The local resolver provides source-port randomization and reduces the risk of forged DNS responses. Apply vendor fixes when they become available.