Avahi-daemon, which implements DNS Service Discovery and Multicast DNS for zero-configuration networking, relies on fixed source ports for wide-area DNS queries. This insufficient randomness simplifies the injection of malicious DNS responses, compromising the integrity of DNS data. The vulnerability is tracked as CVE-2024-52615 with a CVSS 3.1 base score of 5.3 (medium severity). Red Hat has released security advisories RHSA-2025:11402 and RHSA-2025:16441 providing updated packages for Red Hat Enterprise Linux versions 9 and 10 respectively. These updates fix the issue by addressing the use of constant source ports in Avahi's wide-area DNS queries. The vulnerability affects multiple architectures and variants of Red Hat Enterprise Linux 9 and 10. No public exploits are known at this time.

The vulnerability allows attackers to more easily inject malicious DNS responses due to the use of fixed source ports in Avahi's wide-area DNS queries. This compromises the integrity of DNS responses, potentially leading to DNS spoofing or redirection attacks. There is no impact on confidentiality or availability reported. No known exploits in the wild have been documented.

Official patches are available from Red Hat for affected versions of Avahi in Red Hat Enterprise Linux 9 and 10. Users should apply the security updates as described in Red Hat advisories RHSA-2025:11402 and RHSA-2025:16441. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these updates mitigates the vulnerability by eliminating the use of constant source ports for wide-area DNS queries. No additional mitigation actions are required beyond applying the vendor-provided fixes.