CVE-2024-52616

Published: Nov 21, 2024Modified: Jun 29, 2026Deferred

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.

Related CWEs

CWE-334

Small Space of Random Values

The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.

References (4)

https://access.redhat.com/errata/RHSA-2025:7437

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2024-52616

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2326429

Source: secalert@redhat.com

https://github.com/avahi/avahi/pull/577

Source: secalert@redhat.com

Timeline

No history available yet.