Avahi

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. Avahi sits at Tier 2, where the panel grades a merged patch from $100 for a one-liner up to $5,000 for a complicated, high-impact improvement, entirely at its discretion. Patches must be at least one month and no more than twelve months old, maintainers hold a veto, the panel may split the award with them, and sanctions and territory exclusions apply. CVE history 6 Last 12 months 27 Lifetime Denial of service 40 % Memory safety 25 % Parsing/validation 20 % Access control 10 % Latest advisories Loading the feed Overview Avahi is the mDNS and DNS-SD stack on effectively every Linux desktop and a very large share of Linux servers, NAS boxes and embedded images: CUPS printing, network file-share discovery, Chromecast and AirPlay discovery and most IoT provisioning flows all depend on it. avahi-daemon listens on UDP/5353 on every local interface and processes packets from any host on the same L2 segment with no authentication, having historically run as a privileged system daemon. That is one of the very few pre-auth attack surfaces present by default on a stock Linux install. Twenty-seven CVEs lifetime and six in the last twelve months say it is still producing. The project pays nothing for a vulnerability report, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The mDNS and DNS-SD packet parser in avahi-core , reachable from any unauthenticated host on the local link, the origin of CVE-2021-3468 and of the 2023 CVE-2023-1981 assert cluster The D-Bus interface exposed by avahi-daemon , where a local unprivileged caller reaches a daemon that has historically run as root Record and hostname conflict resolution, and the probe and announce state machine that drives it avahi-dnsconfd and the path on which the daemon writes resolver configuration for the rest of the system The client library libavahi-client , which browsers, printing stacks and file managers link against and feed with daemon-supplied data Out of scope The fact that mDNS has no authentication, which is a property of the protocol rather than a defect in this implementation Apple's Bonjour and mDNSResponder, which are a different implementation of the same protocol AppArmor and SELinux policy gaps introduced by a distribution rather than by Avahi itself Local denial of service triggered by a user who already holds a session on the machine One-line fixes for non-exploitable crashes, which the Patch Rewards rules exclude by name along with resource-exhaustion denial of service Most-valued findings Remote, unauthenticated memory corruption in the avahi-core packet parser driven purely by link-local traffic, which is the highest-consequence shape this daemon can produce and the one the reward panel grades at the top of its ladder A structural hardening of the parser that closes a whole class of malformed-record handling rather than one crash, since Patch Rewards pays most for improvements that prevent future vulnerabilities rather than fix a single one Privilege escalation across the D-Bus boundary, where a local unprivileged process reaches something the root daemon should never have exposed Remotely triggerable denial of service, the largest slice of Avahi's CVE history at 40%, where the fix is systematic rather than a single bounds check Any of the above demonstrated on a default distribution install, since Avahi's value as a target is precisely that nobody chose to enable it Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through the project's GitHub private vulnerability reporting; the maintainer triages there and pays nothing for the report itself Send a detailed, reproducible report with the packet or D-Bus message that triggers it. If we can't reproduce it, it isn't eligible Give the maintainer room to ship a fix before any public writeup If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for a month. That is a separate pathway with its own rules The Patch Rewards side is rate-limited to three submissions per person per month, will not pay for one-liner fixes to non-exploitable crashes, and excludes researchers in sanctioned territories Disclosure Coordinated with the Avahi maintainer through GitHub private vulnerability reporting, which produces a GitHub Security Advisory and a CVE with researcher credit. Avahi came out of a maintenance gap and is active again, so hold the detail until the advisory publishes rather than working to a fixed clock. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability