PT-2023-24209 · Ntpd-Rs · Ntpd-Rs

Mlichvar · Published 2023-05-25 · Updated 2023-06-02 · CVE-2023-33192

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ntpd-rs versions prior to 0.3.3

Description ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes when it is not configured to handle NTS packets. The issue was caused by improper slice indexing, which was replaced by safer alternatives to handle the error condition properly.

Recommendations For versions prior to 0.3.3, upgrade to version 0.3.3 or later to resolve the issue. As a temporary workaround, consider configuring ntpd-rs to run purely as an NTP client, as this mode is not affected by the issue. For machines where serving the time is required, upgrade ntpd-rs as soon as possible, as there is no known workaround.

Exploit

Fix

Weakness Enumeration

CWE-130

Related Identifiers

CVE-2023-33192

GHSA-QWHM-H7V3-MRJX

Affected Products

Ntpd-Rs

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33192.json · Exploit
• https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-qwhm-h7v3-mrjx · Vendor Advisory
• https://github.com/pendulum-project/ntpd-rs/pull/752 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-33192 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33192 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qwhm-h7v3-mrjx · Vendor Advisory
• https://github.com/pendulum-project/ntpd-rs · Note
• https://github.com/pendulum-project/ntpd-rs/releases/tag/v0.3.3 · Note
• https://t.me/cibsecurity/64735 · Telegram Post