GHSA-v83q-83hj-rw38 ntpd NTS client denial of service via wrongly sized cookies
A malicious NTS server can crash ntpd-rs by sending zero-sized or oversized cookies, requiring the use of untrusted NTS sources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-v83q-83hj-rw38?
GHSA-v83q-83hj-rw38 is a denial of service vulnerability in ntpd, published on 28 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Two denial of service vulnerabilities were found in ntpd-rs related to the handling of NTS cookies in our client functionality. Whenever an NTS source is configured and the server behind that source is sending zero-sized cookies or cookies larger than what would fit in our buffer size, ntpd-rs would crash. Only configured NTS sources can abuse these vulnerabilities. NTP sources or third parties that are not configured cannot make use of these vulnerabilities.
For zero-sized cookies: a division by zero would force an exit when the number of new cookies that would need to be requested is calculated. In ntpd-rs 1.5.0 a check was added to prevent the division by zero.
For large cookies: while trying to send a NTP request with the cookie included, the buffer is too small to handle the cookie and an exit of ntpd-rs is forced once a write to the buffer is attempted. The memory outside the buffer would not be written to in this case. In ntpd-rs 1.5.0 a check was added that prevents accepting cookies larger than 350 bytes.
Users of older versions of ntpd-rs are recommended to update to the latest version. If an update is impossible, it is recommended to only add NTS sources to ntpd-rs that are trusted to not abuse this bug.
Which versions are affected by GHSA-v83q-83hj-rw38?
2 open source packages ship an affected version, including ntpd.
| Package | Affected | Fixed in |
|---|---|---|
ntpd crates.io | All versions | 1.5.0 |
ntpd crates.io | All versions | 1.5.0 |
How do I fix GHSA-v83q-83hj-rw38?
Upgrade ntpd to 1.5.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-v83q-83hj-rw38 being exploited?
There is no known exploitation of GHSA-v83q-83hj-rw38 in the wild and no public exploit code.