Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 15 Feb 2021 12:50:49 +0100
From: Matthias Gerstner <>
Subject: CVE-2021-26720: avahi-daemon: 'avahi' to 'root' user privilege
 escalation through Debian specific if-up script

Hello list,

the avahi-daemon package [1] in Debian Linux contains a Debian specific
script installed in


This script is run as 'root' via the if-up.d script in


There are security issues in the code of the main shell script in this
context. The $RUNDIR "/run/avahi-daemon" is owned by the unprivileged
avahi:avahi user/group. This fact is also enforced in the script via its
`ensure_rundir()` function.

In line 136

    `touch ${DISABLE_TAG}`

symlinks are followed in "/run/avahi-daemon/disabled-for-unicast-local".
Thus the unprivileged 'avahi' user can trigger an arbitrary file to be
created or an arbitrary file's timestamp updated when this script runs.

Similarly in line 94

    `cat /etc/resolv.conf | grep "nameserver" | sort > ${TMP_CACHE} || return 0`

symlinks are followed in "/run/avahi-daemon/checked_nameservers.<PID>",
which is a predictable path. Content from /etc/resolv.conf will be
written to this location. This would allow for denial of service by
overwriting arbitrary existing files.

SUSE Linux distributions ship an outdated copy of this script in the avahi
package [2] that is also affected by these issues.

To fix these issues I consider it best to run the script as the avahi
user and group by dropping privileges in
"/etc/network/if-up.d/avahi-daemon" via tools like `setpriv` or `su`.

I privately reported this issue to the Debian security team on 2021-01-29. If
I understood correctly then Debian Linux will not ship this script in future
releases any more. A bugfix for Debian Buster will be included in the next
point release [3]. Affected packages in maintained SUSE Linux distributions
will also receive bugfixes [4].




Matthias Gerstner <>
Dipl.-Wirtsch.-Inf. (FH), Security Engineer
Phone: +49 911 740 53 290
GPG Key ID: 0x14C405C971923553
SUSE Software Solutions Germany GmbH
HRB 36809, AG Nürnberg
Geschäftsführer: Felix Imendörffer

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.