{"answers":{"affected":"","exploited":"There is no known exploitation of SUSE-SU-2025:20846-1 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"SUSE-SU-2025:20846-1 is a vulnerability in chrony, published on 14 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for SUSE-SU-2025:20846-1 and fix it if it is affected.\n\nWhat it is: SUSE-SU-2025:20846-1 is a vulnerability in chrony, published on 14 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of SUSE-SU-2025:20846-1 in the wild and no public exploit code.\n\nAffected product: chrony. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/SUSE-SU-2025-20846-1/ (Markdown: https://insights.sbomify.com/SUSE-SU-2025-20846-1/index.md)","id":"SUSE-SU-2025:20846-1","markdown":"https://insights.sbomify.com/SUSE-SU-2025-20846-1/index.md","name":"SUSE-SU-2025:20846-1","record":{"aliases":[],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"SUSE Linux","requires_auth":"none","summary":"A race condition in chrony socket creation allows local attackers to escalate privileges to root on SUSE Linux systems.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"This update for chrony fixes the following issues:\n\n- Update to version 4.8:\n  * Add maxunreach option to limit selection of unreachable sources\n  * Add -u option to chronyc to drop root privileges (default\n    chronyc user is set by configure script)\n  * Fix refclock extpps option to work on Linux \u003e= 6.15\n  * Validate refclock samples for reachability updates\n\n- Fix racy socket creation allowing privilege escalation to root (bsc#1246544)\n\n- Update to version 4.7:\n  * Add opencommands directive to select remote monitoring\n    commands\n  * Add interval option to driftfile directive\n  * Add waitsynced and waitunsynced options to local directive\n  * Add sanity checks for integer values in configuration\n  * Add support for systemd Type=notify service\n  * Add RTC refclock driver\n  * Allow PHC refclock to be specified with network interface name\n  * Don’t require multiple refclock samples per poll to simplify\n    filter configuration\n  * Keep refclock reachable when dropping samples with large delay\n  * Improve quantile-based filtering to adapt faster to larger\n    delay\n  * Improve logging of selection failures\n  * Detect clock interference from other processes\n  * Try to reopen message log (-l option) on cyclelogs command\n  * Fix sourcedir reloading to not multiply sources\n  * Fix tracking offset after failed clock step\n  * Drop support for NTS with Nettle \u003c 3.6 and GnuTLS \u003c 3.6.14\n  * Drop support for building without POSIX threads\n\n- Update to version 4.6.1:\n  * Add ntsaeads directive to enable only selected AEAD algorithms\n    for NTS.\n  * Negotiate use of compliant NTS keys with AES-128-GCM-SIV AEAD\n    algorithm.\n  * Switch to compliant NTS keys if first response from server is\n    NTS NAK.\n\n- Drop rcFOO symlinks for CODE16 (PED-266).\n\n- Update to version 4.6:\n  * Add activate option to local directive to set activation threshold\n  * Add ipv4 and ipv6 options to server/pool/peer directive\n  * Add kod option to ratelimit directive for server KoD RATE support\n  * Add leapseclist directive to read NIST/IERS leap-seconds.list file\n  * Add ptpdomain directive to set PTP domain for NTP over PTP\n  * Allow disabling pidfile\n  * Improve copy server option to accept unsynchronised status instantly\n  * Log one selection failure on start\n  * Add offset command to modify source offset correction\n  * Add timestamp sources to ntpdata report\n  * Fix crash on sources reload during initstepslew or RTC initialisation\n  * Fix source refreshment to not repeat failed name resolving attempts\n\n- Update to version 4.5:\n  * Add support for AES-GCM-SIV in GnuTLS\n  * Add support for corrections from PTP transparent clocks\n  * Add support for systemd socket activation\n  * Fix presend in interleaved mode\n  * Fix reloading of modified sources from sourcedir","ecosystems":["SUSE:Linux Micro 6.0"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Security update for chrony","id":"SUSE-SU-2025:20846-1","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2025"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"SUSE:Linux Micro 6.0","fixed":["4.8-1.1"],"introduced":["0"],"last_affected":[],"package":"chrony","purl":"pkg:rpm/suse/chrony\u0026distro=SUSE%20Linux%20Micro%206.0","source":"SUSE-SU-2025:20846-1"}],"products":null,"published":"2025-10-14","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"SUSE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A race condition in chrony socket creation allows local attackers to escalate privileges to root on SUSE Linux systems.","url":"https://insights.sbomify.com/SUSE-SU-2025-20846-1/"}