CLSA-2026-1787932412
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1787932412.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1787932412
- Upstream
- Published
- 2026-08-29T10:28:02Z
- Modified
- 2026-10-26T09:32:03Z
- Summary
- Fix CVE(s): CVE-2021-26720
- Details
-
- SECURITY UPDATE: local symlink attack through the unicast .local DNS
check: /etc/network/if-up.d/avahi-daemon exec's
/usr/lib/avahi/avahi-daemon-check-dns.sh as root, and the script
writes into /run/avahi-daemon (the checked_nameservers[.$$] cache and
the disabled-for-unicast-local tag) without protecting against
symlinks, so a local attacker able to place symlinks in that
avahi-owned directory can make root create arbitrary empty files or
cause a denial of service.
- debian/avahi-daemon.if-up: run the check script under "sudo -u avahi -g avahi" instead of exec'ing it as root, so the writes are performed by the same unprivileged account that owns /run/avahi-daemon. Backported verbatim from Debian stretch 0.6.32-2+deb9u1 (DLA-3047-1); the alternative vendor fix, dropping the check-dns mechanism outright (Debian buster 0.7-4+deb10u1, Ubuntu focal 0.7-4ubuntu7), is not applicable here because bionic ships libnss-mdns 0.10-8ubuntu1, the same generation as stretch.
- debian/control: add sudo to the avahi-daemon Depends, required by the privilege drop.
- CVE-2021-26720
- SECURITY UPDATE: local symlink attack through the unicast .local DNS
check: /etc/network/if-up.d/avahi-daemon exec's
/usr/lib/avahi/avahi-daemon-check-dns.sh as root, and the script
writes into /run/avahi-daemon (the checked_nameservers[.$$] cache and
the disabled-for-unicast-local tag) without protecting against
symlinks, so a local attacker able to place symlinks in that
avahi-owned directory can make root create arbitrary empty files or
cause a denial of service.
- References