Bug 1216853 (CVE-2023-38472)

Summary: VUL-0: CVE-2023-38472: avahi: Reachable assertion in avahi_rdata_parse
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: IN_PROGRESS --- QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: alynx.zhou, camila.matos, gianluca.gabrielli, gnome-bugs, mgorse, praveenkumar.handigol, stoyan.manolov
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/372782/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-38472:6.2:(AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description SMASH SMASH 2023-11-03 08:58:43 UTC
A vulnerability was found in Avahi. A reachable assertion exists in the
avahi_rdata_parse() function.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38472
https://github.com/lathiat/avahi/issues/452
https://github.com/lathiat/avahi/pull/490
Comment 1 Gianluca Gabrielli 2023-11-03 09:05:14 UTC
Affected packages:
- openSUSE:Factory/avahi
- SUSE:SLE-15-SP1:Update/avahi
- SUSE:SLE-12-SP2:Update/avahi
- SUSE:ALP:Source:Standard:1.0/avahi
- SUSE:SLE-15-SP4:Update/avahi
- SUSE:SLE-11-SP3:Update/avahi
- SUSE:SLE-15:Update/avahi

Upstream patch: https://github.com/lathiat/avahi/commit/b024ae5749f4aeba03478e6391687c3c9c8dee40
Comment 5 Alynx Zhou 2023-11-30 04:56:03 UTC
Hi, I'll try to handle this.
Comment 7 Alynx Zhou 2023-11-30 05:19:57 UTC
It looks like we don't have `fuzz` support in current version of avahi, so for PR <https://github.com/lathiat/avahi/pull/492>, I think backport <https://github.com/lathiat/avahi/pull/492/commits/160e8fb6ca1b33387f30f7a6aa9159015ffda9d0> is enough.
Comment 8 Alynx Zhou 2023-11-30 05:47:39 UTC
https://build.opensuse.org/request/show/1129882
For GNOME:Factory.
https://build.opensuse.org/request/show/1129885
For GNOME:STABLE:41
Comment 9 Alynx Zhou 2023-11-30 06:54:22 UTC
https://build.suse.de/request/show/314049
For Devel:Desktop:SLE12:SP2
https://build.suse.de/request/show/314050
For Devel:Desktop:SLE-15-SP1
Comment 10 Alynx Zhou 2023-12-01 05:37:16 UTC
https://build.suse.de/request/show/314141
For Devel:Desktop:SLE12:SP2
https://build.suse.de/request/show/314142
For Devel:Desktop:SLE-15-SP1
Comment 11 Alynx Zhou 2023-12-01 06:02:05 UTC
https://build.opensuse.org/request/show/1129990
For openSUSE:Factory
https://build.suse.de/request/show/314143
For SUSE:ALP:Source:Standard:1.0/avahi
https://build.suse.de/request/show/314144
For SLE-15-SP4
Comment 13 Maintenance Automation 2023-12-19 12:30:02 UTC
SUSE-SU-2023:4901-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1216853
CVE References: CVE-2023-38472
Sources used:
openSUSE Leap 15.4 (src): avahi-0.8-150400.7.13.1, avahi-qt5-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1
openSUSE Leap Micro 5.3 (src): avahi-0.8-150400.7.13.1
openSUSE Leap Micro 5.4 (src): avahi-0.8-150400.7.13.1
openSUSE Leap 15.5 (src): avahi-0.8-150400.7.13.1, avahi-qt5-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): avahi-0.8-150400.7.13.1
SUSE Linux Enterprise Micro 5.3 (src): avahi-0.8-150400.7.13.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): avahi-0.8-150400.7.13.1
SUSE Linux Enterprise Micro 5.4 (src): avahi-0.8-150400.7.13.1
SUSE Linux Enterprise Micro 5.5 (src): avahi-0.8-150400.7.13.1
Basesystem Module 15-SP4 (src): avahi-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1
Basesystem Module 15-SP5 (src): avahi-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1
Desktop Applications Module 15-SP4 (src): avahi-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1
Desktop Applications Module 15-SP5 (src): avahi-0.8-150400.7.13.1, avahi-glib2-0.8-150400.7.13.1
SUSE Package Hub 15 15-SP4 (src): avahi-0.8-150400.7.13.1
SUSE Package Hub 15 15-SP5 (src): avahi-0.8-150400.7.13.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 PraveenKumar Handigol 2024-01-17 10:35:05 UTC
I am in the process of building Avahi CVE fixes by checking out the sources from dev branches. I will raise SR for code review shortly.
Comment 20 Maintenance Automation 2024-05-06 12:31:29 UTC
SUSE-SU-2024:1500-1: An update that solves two vulnerabilities can now be installed.

Category: security (moderate)
Bug References: 1215947, 1216853
CVE References: CVE-2023-38470, CVE-2023-38472
Maintenance Incident: [SUSE:Maintenance:33589](https://smelt.suse.de/incident/33589/)
Sources used:
SUSE Linux Enterprise Workstation Extension 12 12-SP5 (src):
 avahi-glib2-0.6.32-32.27.1
SUSE Linux Enterprise Software Development Kit 12 SP5 (src):
 avahi-0.6.32-32.27.1, avahi-glib2-0.6.32-32.27.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src):
 avahi-0.6.32-32.27.1, avahi-glib2-0.6.32-32.27.1
SUSE Linux Enterprise Server 12 SP5 (src):
 avahi-0.6.32-32.27.1, avahi-glib2-0.6.32-32.27.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src):
 avahi-0.6.32-32.27.1, avahi-glib2-0.6.32-32.27.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 23 Maintenance Automation 2024-05-09 12:30:12 UTC
SUSE-SU-2024:1569-1: An update that solves one vulnerability can now be installed.

Category: security (moderate)
Bug References: 1216853
CVE References: CVE-2023-38472
Maintenance Incident: [SUSE:Maintenance:33718](https://smelt.suse.de/incident/33718/)
Sources used:
SUSE Linux Enterprise Micro 5.2 (src):
 avahi-0.7-150100.3.35.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src):
 avahi-0.7-150100.3.35.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.