openRuyi-tutorials/buildroot
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
master
buildroot/package/avahi/avahi.mk
T
Thomas Perale e728d3506b package/avahi: patch various security vulnerabilities 
Please note that the fix for CVE-2024-52615 introduces CVE-2025-59529
which is not fixed yet (https://github.com/avahi/avahi/pull/808). You
can mitigate this vulnerability by setting the `enable-wide-area=no`
option.

Patch `0011-properly-randomize-query-id-of-DNS-packets.patch` modify
`configure.ac` and then `AVAHI_AUTORECONF` is set.

This commit fixes the following vulnerabilities:

- CVE-2021-3468:
    A flaw was found in avahi in versions 0.6 up to 0.8. The event used to
    signal the termination of the client connection on the avahi Unix
    socket is not correctly handled in the client_work function, allowing
    a local attacker to trigger an infinite loop. The highest threat from
    this vulnerability is to the availability of the avahi service, which
    becomes unresponsive after this flaw is triggered.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2021-3468
    - https://github.com/avahi/avahi/commit/447affe29991ee99c6b9732fc5f2c1048a611d3b

- CVE-2023-38469:
    A vulnerability was found in Avahi, where a reachable assertion exists
    in avahi_dns_packet_append_record.
    https://www.cve.org/CVERecord?id=CVE-2023-38469

- CVE-2023-38470:
    A vulnerability was found in Avahi. A reachable assertion exists in
    the avahi_escape_label() function.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2023-38470
    - https://github.com/avahi/avahi/commit/a337a1ba7d15853fb56deef1f464529af6e3a1cf

- CVE-2023-38471:
    A vulnerability was found in Avahi. A reachable assertion exists in
    the dbus_set_host_name function.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2023-38471
    - github.com/avahi/avahi/commit/894f085f402e023a98cbb6f5a3d117bd88d93b09

- CVE-2023-38472:
    A vulnerability was found in Avahi. A reachable assertion exists in
    the avahi_rdata_parse() function.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2023-38472
    - https://github.com/avahi/avahi/commit/b024ae5749f4aeba03478e6391687c3c9c8dee40

- CVE-2023-38473:
    A vulnerability was found in Avahi. A reachable assertion exists in
    the avahi_alternative_host_name() function.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2023-38473
    - https://github.com/avahi/avahi/commit/b448c9f771bada14ae8de175695a9729f8646797

- CVE-2024-52615:
    A flaw was found in Avahi-daemon, which relies on fixed source ports
    for wide-area DNS queries. This issue simplifies attacks where
    malicious DNS responses are injected.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2024-52615
    - https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942
    - https://github.com/avahi/avahi/issues/810 (introduce regression CVE-2025-59529)

- CVE-2024-52616:
    A flaw was found in the Avahi-daemon, where it initializes DNS
    transaction IDs randomly only once at startup, incrementing them
    sequentially after that. This predictable behavior facilitates DNS
    spoofing attacks, allowing attackers to guess transaction IDs.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2024-52616
    - https://github.com/avahi/avahi/commit/f8710bdc8b29ee1176fe3bfaeabebbda1b7a79f7

- CVE-2025-68276:
    Avahi is a system which facilitates service discovery on a local
    network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an
    unprivileged local users can crash avahi-daemon (with wide-area
    disabled) by creating record browsers with the
    AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by
    either calling the RecordBrowserNew method directly or creating
    hostname/address/service resolvers/browsers that create those browsers
    internally themselves.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2025-68276
    - https://github.com/avahi/avahi/commit/2d48e42d44a183f26a4d12d1f5d41abb9b7c6355

- CVE-2025-68468:
    Avahi is a system which facilitates service discovery on a local
    network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier,
    avahi-daemon can be crashed by sending unsolicited announcements
    containing CNAME resource records pointing it to resource records with
    short TTLs. As soon as they expire avahi-daemon crashes.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2025-68468
    - https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a

- CVE-2025-68471:
    Avahi is a system which facilitates service discovery on a local
    network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier,
    avahi-daemon can be crashed by sending 2 unsolicited announcements
    with CNAME resource records 2 seconds apart.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2025-68471
    - https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1

- CVE-2026-24401:
    Avahi is a system which facilitates service discovery on a local
    network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and
    below, avahi-daemon can be crashed via a segmentation fault by sending
    an unsolicited mDNS response containing a recursive CNAME record,
    where the alias and canonical name point to the same domain (e.g.,
    "h.local" as a CNAME for "h.local"). This causes unbounded recursion
    in the lookup_handle_cname function, leading to stack exhaustion. The
    vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST
    is set explicitly, which includes record browsers created by resolvers
    used by nss-mdns. This issue is patched in commit
    78eab31128479f06e30beb8c1cbf99dd921e2524.

For more information, see:
    - https://www.cve.org/CVERecord?id=CVE-2026-24401
    - https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-02-13 09:45:23 +01:00

250 lines
6.8 KiB
Makefile
Raw Permalink Blame History

################################################################################
#
# avahi
#
################################################################################
AVAHI_VERSION = 0.8
AVAHI_SITE = https://github.com/avahi/avahi/releases/download/v$(AVAHI_VERSION)
AVAHI_LICENSE = LGPL-2.1+
AVAHI_LICENSE_FILES = LICENSE
AVAHI_CPE_ID_VENDOR = avahi
AVAHI_SELINUX_MODULES = avahi
AVAHI_INSTALL_STAGING = YES
# 0011-properly-randomize-query-id-of-DNS-packets.patch
AVAHI_AUTORECONF = YES
# CVE-2021-26720 is an issue in avahi-daemon-check-dns.sh, which is
# part of the Debian packaging and not part of upstream avahi
AVAHI_IGNORE_CVES += CVE-2021-26720
# 0001-Fix-NULL-pointer-crashes-from-175.patch
AVAHI_IGNORE_CVES += CVE-2021-36217
# 0003-avoid-infinite-loop-in-avahi-daemon-by-handling-hup-event-in-client-work.patch
AVAHI_IGNORE_CVES += CVE-2021-3468
# 0004-core-reject-overly-long-txt-resource-records.patch
AVAHI_IGNORE_CVES += CVE-2023-38469
# 0005-ensure-each-label-is-at-least-one-byte-long.patch
# 0006-common-bail-out-when-escaped-labels-can-t-fit-into-ret.patch
AVAHI_IGNORE_CVES += CVE-2023-38470
# 0007-core-extract-host-name-using-avahi-unescape-label.patch
# 0008-core-return-errors-from-avahi-server-set-host-name-properly.patch
AVAHI_IGNORE_CVES += CVE-2023-38471
# 0009-core-make-sure-there-is-rdata-to-process-before-parsing-it.patch
AVAHI_IGNORE_CVES += CVE-2023-38472
# 0010-common-derive-alternative-host-name-from-its-unescaped-version.patch
AVAHI_IGNORE_CVES += CVE-2023-38473
# 0011-properly-randomize-query-id-of-DNS-packets.patch
AVAHI_IGNORE_CVES += CVE-2024-52616
# 0012-core-wide-area-fix-for-CVE-2024-52615.patch
AVAHI_IGNORE_CVES += CVE-2024-52615
# 0013-core-refuse-to-create-wide-area-record-browsers-when-wide-area-is-off.patch
AVAHI_IGNORE_CVES += CVE-2025-68276
# 0014-core-fix-DoS-bug-by-removing-incorrect-assertion.patch
AVAHI_IGNORE_CVES += CVE-2025-68468
# 0015-core-fix-DoS-bug-by-changing-assert-to-return.patch
AVAHI_IGNORE_CVES += CVE-2025-68471
# 0016-core-fix-uncontrolled-recursion-bug-using-a-simple-loop-detection-algorithm.patch
AVAHI_IGNORE_CVES += CVE-2026-24401
AVAHI_CONF_ENV = \
avahi_cv_sys_cxx_works=yes \
DATADIRNAME=share
# Note: even if we have Gtk2 and Gtk3 support in Buildroot, we
# explicitly disable support for them, in order to avoid the following
# circular dependencies:
#
# avahi -> libgtk3 -> cups -> avahi
#
# Since Gtk3 in Avahi is only used for some example/demo programs,
# we decided to disable their support to solve the circular dependency.
AVAHI_CONF_OPTS = \
--disable-qt3 \
--disable-qt4 \
--disable-qt5 \
--disable-gtk \
--disable-gtk3 \
--disable-gdbm \
--disable-mono \
--disable-monodoc \
--disable-stack-protector \
--disable-introspection \
--with-distro=none \
--disable-manpages \
$(if $(BR2_PACKAGE_AVAHI_AUTOIPD),--enable,--disable)-autoipd \
--with-avahi-user=avahi \
--with-avahi-group=avahi \
--with-autoipd-user=avahi \
--with-autoipd-group=avahi
AVAHI_DEPENDENCIES = host-pkgconf $(TARGET_NLS_DEPENDENCIES)
AVAHI_CFLAGS = $(TARGET_CFLAGS)
ifeq ($(BR2_PACKAGE_SYSTEMD),y)
AVAHI_CONF_OPTS += --with-systemdsystemunitdir=/usr/lib/systemd/system
else
AVAHI_CONF_OPTS += --with-systemdsystemunitdir=no
AVAHI_CFLAGS += -DDISABLE_SYSTEMD
endif
ifneq ($(BR2_PACKAGE_AVAHI_DAEMON)$(BR2_PACKAGE_AVAHI_AUTOIPD),)
AVAHI_DEPENDENCIES += libdaemon
else
AVAHI_CONF_OPTS += --disable-libdaemon
endif
ifeq ($(BR2_PACKAGE_LIBCAP),y)
AVAHI_DEPENDENCIES += libcap
endif
ifeq ($(BR2_PACKAGE_AVAHI_DAEMON),y)
AVAHI_DEPENDENCIES += expat
AVAHI_CONF_OPTS += --with-xml=expat
else
AVAHI_CONF_OPTS += --with-xml=none
endif
ifeq ($(BR2_PACKAGE_AVAHI_LIBDNSSD_COMPATIBILITY),y)
AVAHI_CONF_OPTS += --enable-compat-libdns_sd
endif
ifeq ($(BR2_PACKAGE_DBUS),y)
AVAHI_DEPENDENCIES += dbus
AVAHI_CONF_OPTS += --with-dbus-sys=/usr/share/dbus-1/system.d
else
AVAHI_CONF_OPTS += --disable-dbus
endif
ifeq ($(BR2_PACKAGE_LIBEVENT),y)
AVAHI_DEPENDENCIES += libevent
else
AVAHI_CONF_OPTS += --disable-libevent
endif
ifeq ($(BR2_PACKAGE_LIBGLIB2),y)
AVAHI_DEPENDENCIES += libglib2
else
AVAHI_CONF_OPTS += --disable-glib --disable-gobject
endif
ifeq ($(BR2_PACKAGE_PYTHON3),y)
AVAHI_CONF_ENV += \
am_cv_pathless_PYTHON=python3 \
am_cv_python_version=$(PYTHON3_VERSION) \
am_cv_python_platform=linux5 \
am_cv_python_pythondir=/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages \
am_cv_python_pyexecdir=/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages \
py_cv_mod_socket_=yes
AVAHI_DEPENDENCIES += python3
AVAHI_CONF_OPTS += --enable-python
else
AVAHI_CONF_OPTS += --disable-python
endif
ifeq ($(BR2_PACKAGE_DBUS_PYTHON),y)
AVAHI_CONF_OPTS += --enable-python-dbus
AVAHI_CONF_ENV += py_cv_mod_dbus_=yes
AVAHI_DEPENDENCIES += dbus-python
else
AVAHI_CONF_OPTS += --disable-python-dbus
endif
ifeq ($(BR2_PACKAGE_PYTHON_GOBJECT),y)
AVAHI_CONF_OPTS += --enable-pygobject
AVAHI_DEPENDENCIES += python-gobject
else
AVAHI_CONF_OPTS += --disable-pygobject
endif
AVAHI_CONF_ENV += CFLAGS="$(AVAHI_CFLAGS)"
AVAHI_MAKE_OPTS += LIBS=$(TARGET_NLS_LIBS)
define AVAHI_USERS
avahi -1 avahi -1 * - - -
endef
define AVAHI_REMOVE_INITSCRIPT
rm -rf $(TARGET_DIR)/etc/init.d/avahi-*
endef
AVAHI_POST_INSTALL_TARGET_HOOKS += AVAHI_REMOVE_INITSCRIPT
ifeq ($(BR2_PACKAGE_AVAHI_AUTOIPD),y)
define AVAHI_INSTALL_AUTOIPD
rm -f $(TARGET_DIR)/var/lib/avahi-autoipd
$(INSTALL) -d -m 0755 $(TARGET_DIR)/var/lib
ln -sf /tmp/avahi-autoipd $(TARGET_DIR)/var/lib/avahi-autoipd
endef
define AVAHI_INSTALL_AUTOIPD_INIT_SYSV
$(INSTALL) -D -m 0755 package/avahi/S05avahi-setup.sh $(TARGET_DIR)/etc/init.d/S05avahi-setup.sh
endef
AVAHI_POST_INSTALL_TARGET_HOOKS += AVAHI_INSTALL_AUTOIPD
endif
ifeq ($(BR2_PACKAGE_AVAHI_DAEMON),y)
ifeq ($(BR2_PACKAGE_SYSTEMD_SYSUSERS),y)
define AVAHI_INSTALL_SYSTEMD_SYSUSERS
$(INSTALL) -D -m 644 package/avahi/avahi_sysusers.conf \
$(TARGET_DIR)/usr/lib/sysusers.d/avahi.conf
endef
endif
define AVAHI_INSTALL_INIT_SYSTEMD
$(INSTALL) -D -m 644 package/avahi/avahi_tmpfiles.conf \
$(TARGET_DIR)/usr/lib/tmpfiles.d/avahi.conf
$(AVAHI_INSTALL_SYSTEMD_SYSUSERS)
endef
define AVAHI_INSTALL_DAEMON_INIT_SYSV
$(INSTALL) -D -m 0755 package/avahi/S50avahi-daemon $(TARGET_DIR)/etc/init.d/S50avahi-daemon
endef
endif
define AVAHI_INSTALL_INIT_SYSV
$(AVAHI_INSTALL_AUTOIPD_INIT_SYSV)
$(AVAHI_INSTALL_DAEMON_INIT_SYSV)
endef
ifeq ($(BR2_PACKAGE_AVAHI_LIBDNSSD_COMPATIBILITY),y)
# applications expects to be able to #include <dns_sd.h>
define AVAHI_STAGING_INSTALL_LIBDNSSD_LINK
ln -sf avahi-compat-libdns_sd/dns_sd.h \
$(STAGING_DIR)/usr/include/dns_sd.h
endef
AVAHI_POST_INSTALL_STAGING_HOOKS += AVAHI_STAGING_INSTALL_LIBDNSSD_LINK
endif
ifeq ($(BR2_PACKAGE_AVAHI_DEFAULT_SERVICES),)
define AVAHI_REMOVE_DEFAULT_SERVICES
$(foreach service,ssh sftp-ssh, \
$(RM) -f $(TARGET_DIR)/etc/avahi/services/$(service).service
)
endef
AVAHI_POST_INSTALL_TARGET_HOOKS += AVAHI_REMOVE_DEFAULT_SERVICES
endif
$(eval $(autotools-package))
Reference in New Issue View Git Blame Copy Permalink