Local Denial of Service Vulnerability in Debian Avahi Package
CVE-2021-26720

7.8HIGH

Key Information:

Vendor: Avahi
Status: Avahi
Vendor: CVE Published:; 17 February 2021

What is CVE-2021-26720?

The avahi-daemon-check-dns.sh script within the Debian avahi package executes with root privileges via the /etc/network/if-up.d/avahi-daemon script. This flaw allows a local attacker to mount a symlink attack, potentially leading to denial of service by creating arbitrary empty files in the /run/avahi-daemon directory. This vulnerability impacts only the packaging for Debian GNU/Linux and indirectly affects SUSE, and does not pertain to the upstream Avahi product.