Version in base suite: 0.8-5+deb11u1 Base version: avahi_0.8-5+deb11u1 Target version: avahi_0.8-5+deb11u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/a/avahi/avahi_0.8-5+deb11u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/a/avahi/avahi_0.8-5+deb11u2.dsc changelog | 8 ++ patches/Avoid-infinite-loop-in-avahi-daemon-by-handling-HUP-event.patch | 38 ++++++++++ patches/series | 1 3 files changed, 47 insertions(+) diff -Nru avahi-0.8/debian/changelog avahi-0.8/debian/changelog --- avahi-0.8/debian/changelog 2022-08-08 09:27:46.000000000 +0000 +++ avahi-0.8/debian/changelog 2023-01-10 08:43:16.000000000 +0000 @@ -1,3 +1,11 @@ +avahi (0.8-5+deb11u2) bullseye; urgency=medium + + * Avoid infinite-loop in avahi-daemon by handling HUP event in client_work. + Fixes a local DoS that could be triggered by writing long lines to + /run/avahi-daemon/socket. (CVE-2021-3468, Closes: #984938) + + -- Michael Biebl Tue, 10 Jan 2023 09:43:16 +0100 + avahi (0.8-5+deb11u1) bullseye; urgency=medium [ Simon McVittie ] diff -Nru avahi-0.8/debian/patches/Avoid-infinite-loop-in-avahi-daemon-by-handling-HUP-event.patch avahi-0.8/debian/patches/Avoid-infinite-loop-in-avahi-daemon-by-handling-HUP-event.patch --- avahi-0.8/debian/patches/Avoid-infinite-loop-in-avahi-daemon-by-handling-HUP-event.patch 1970-01-01 00:00:00.000000000 +0000 +++ avahi-0.8/debian/patches/Avoid-infinite-loop-in-avahi-daemon-by-handling-HUP-event.patch 2023-01-10 08:43:16.000000000 +0000 @@ -0,0 +1,38 @@ +From: Riccardo Schirone +Date: Fri, 26 Mar 2021 11:50:24 +0100 +Subject: Avoid infinite-loop in avahi-daemon by handling HUP event in + client_work + +If a client fills the input buffer, client_work() disables the +AVAHI_WATCH_IN event, thus preventing the function from executing the +`read` syscall the next times it is called. However, if the client then +terminates the connection, the socket file descriptor receives a HUP +event, which is not handled, thus the kernel keeps marking the HUP event +as occurring. While iterating over the file descriptors that triggered +an event, the client file descriptor will keep having the HUP event and +the client_work() function is always called with AVAHI_WATCH_HUP but +without nothing being done, thus entering an infinite loop. + +See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=984938 + +(cherry picked from commit 447affe29991ee99c6b9732fc5f2c1048a611d3b) +--- + avahi-daemon/simple-protocol.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/avahi-daemon/simple-protocol.c b/avahi-daemon/simple-protocol.c +index 3e0ebb1..6c0274d 100644 +--- a/avahi-daemon/simple-protocol.c ++++ b/avahi-daemon/simple-protocol.c +@@ -424,6 +424,11 @@ static void client_work(AvahiWatch *watch, AVAHI_GCC_UNUSED int fd, AvahiWatchEv + } + } + ++ if (events & AVAHI_WATCH_HUP) { ++ client_free(c); ++ return; ++ } ++ + c->server->poll_api->watch_update( + watch, + (c->outbuf_length > 0 ? AVAHI_WATCH_OUT : 0) | diff -Nru avahi-0.8/debian/patches/series avahi-0.8/debian/patches/series --- avahi-0.8/debian/patches/series 2022-08-08 09:27:46.000000000 +0000 +++ avahi-0.8/debian/patches/series 2023-01-10 08:43:16.000000000 +0000 @@ -10,3 +10,4 @@ avahi-discover-Escape-strings-substituted-into-Pango-mark.patch Do-not-disable-timeout-cleanup-on-watch-cleanup.patch Fix-NULL-pointer-crashes-from-175.patch +Avoid-infinite-loop-in-avahi-daemon-by-handling-HUP-event.patch