CVE-2024-52616

What it actually does

The Avahi daemon initializes DNS transaction IDs with a single random value at startup and then increments them sequentially, enabling attackers to predict and spoof responses for DNS transactions.

Why it matters to the business

Attackers can inject false name resolution data into local networks, disrupting service discovery and potentially redirecting traffic or causing availability issues for dependent applications.

How an attack unfolds

An attacker on the local network observes Avahi traffic to determine the initial transaction ID pattern, then crafts spoofed DNS responses with guessed sequential IDs to poison mDNS resolutions used by clients and services.

How to fix it

Upgrade Avahi packages to versions that re-randomize transaction IDs per query or implement stronger cryptographic ID generation; apply the listed fixed versions for affected distributions such as flashplugin-nonfree on Ubuntu 14.04 LTS.

How to confirm the fix worked

Review Avahi source or runtime behavior to confirm transaction IDs are randomized on each query rather than incremented; test by monitoring multiple queries for non-sequential ID distribution.

Typical attack path

1. Observe initial Avahi mDNS queries on the local network to capture the starting transaction ID
2. Calculate subsequent IDs based on the sequential increment pattern
3. Send forged DNS responses matching predicted transaction IDs before legitimate replies arrive
4. Poison local caches to redirect service discovery or name resolutions

How to detect it

Inspect system and network logs for repeated mDNS queries followed by responses with sequentially incrementing transaction IDs; correlate with unexpected service discovery failures or redirects.

What your security team should do

• Apply available updates to Avahi immediately given the public nature of the weakness
• Monitor local network traffic for anomalous mDNS responses
• Consider network segmentation to limit exposure of mDNS services
• Review dependencies on Avahi in critical service discovery paths