CVE-2024-52616
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
0 < 0.9 | affected | ||
| Red Hat | Red Hat Enterprise Linux 9 | 0:0.8-22.el9_6 < * | unaffected |
| Red Hat | Red Hat Enterprise Linux 9 | 0:0.8-22.el9_6 < * | unaffected |
Weaknesses
- CWE-334: Small Space of Random Values
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: yes
- Technical Impact: partial
References
- https://access.redhat.com/errata/RHSA-2025:7437
- https://access.redhat.com/security/cve/CVE-2024-52616
- https://bugzilla.redhat.com/show_bug.cgi?id=2326429
- https://github.com/avahi/avahi/pull/577
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.