# GHSA-v83q-83hj-rw38: ntpd NTS client denial of service via wrongly sized cookies > A malicious NTS server can crash ntpd-rs by sending zero-sized or oversized cookies, requiring the use of untrusted NTS sources. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 28 Feb 2025 ## What is GHSA-v83q-83hj-rw38? GHSA-v83q-83hj-rw38 is a denial of service vulnerability in ntpd, published on 28 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description Two denial of service vulnerabilities were found in ntpd-rs related to the handling of NTS cookies in our client functionality. Whenever an NTS source is configured and the server behind that source is sending zero-sized cookies or cookies larger than what would fit in our buffer size, ntpd-rs would crash. Only configured NTS sources can abuse these vulnerabilities. NTP sources or third parties that are not configured cannot make use of these vulnerabilities. For zero-sized cookies: a division by zero would force an exit when the number of new cookies that would need to be requested is calculated. In ntpd-rs 1.5.0 a check was added to prevent the division by zero. For large cookies: while trying to send a NTP request with the cookie included, the buffer is too small to handle the cookie and an exit of ntpd-rs is forced once a write to the buffer is attempted. The memory outside the buffer would not be written to in this case. In ntpd-rs 1.5.0 a check was added that prevents accepting cookies larger than 350 bytes. Users of older versions of ntpd-rs are recommended to update to the latest version. If an update is impossible, it is recommended to only add NTS sources to ntpd-rs that are trusted to not abuse this bug. ## Which versions are affected by GHSA-v83q-83hj-rw38? 2 open source packages ship an affected version, including ntpd. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `ntpd` | crates.io | All versions | 1.5.0 | | `ntpd` | crates.io | All versions | 1.5.0 | ## How do I fix GHSA-v83q-83hj-rw38? Upgrade ntpd to 1.5.0 or later. ## Is GHSA-v83q-83hj-rw38 being exploited? There is no known exploitation of GHSA-v83q-83hj-rw38 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-v83q-83hj-rw38 and fix it if it is affected. What it is: GHSA-v83q-83hj-rw38 is a denial of service vulnerability in ntpd, published on 28 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of GHSA-v83q-83hj-rw38 in the wild and no public exploit code. Affected packages and fixed versions: - ntpd (crates.io): affected all versions; fixed in 1.5.0 - ntpd (crates.io): affected all versions; fixed in 1.5.0 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-v83q-83hj-rw38/ (Markdown: https://insights.sbomify.com/GHSA-v83q-83hj-rw38/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-v83q-83hj-rw38 --- From sbomify Insights: https://insights.sbomify.com/GHSA-v83q-83hj-rw38/ Summaries are generated and may contain mistakes; the official description above is the record.