# SUSE-SU-2025:20846-1: Security update for chrony

> A race condition in chrony socket creation allows local attackers to escalate privileges to root on SUSE Linux systems.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 14 Oct 2025

## What is SUSE-SU-2025:20846-1?

SUSE-SU-2025:20846-1 is a vulnerability in chrony, published on 14 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

This update for chrony fixes the following issues:

- Update to version 4.8:
  * Add maxunreach option to limit selection of unreachable sources
  * Add -u option to chronyc to drop root privileges (default
    chronyc user is set by configure script)
  * Fix refclock extpps option to work on Linux >= 6.15
  * Validate refclock samples for reachability updates

- Fix racy socket creation allowing privilege escalation to root (bsc#1246544)

- Update to version 4.7:
  * Add opencommands directive to select remote monitoring
    commands
  * Add interval option to driftfile directive
  * Add waitsynced and waitunsynced options to local directive
  * Add sanity checks for integer values in configuration
  * Add support for systemd Type=notify service
  * Add RTC refclock driver
  * Allow PHC refclock to be specified with network interface name
  * Don’t require multiple refclock samples per poll to simplify
    filter configuration
  * Keep refclock reachable when dropping samples with large delay
  * Improve quantile-based filtering to adapt faster to larger
    delay
  * Improve logging of selection failures
  * Detect clock interference from other processes
  * Try to reopen message log (-l option) on cyclelogs command
  * Fix sourcedir reloading to not multiply sources
  * Fix tracking offset after failed clock step
  * Drop support for NTS with Nettle < 3.6 and GnuTLS < 3.6.14
  * Drop support for building without POSIX threads

- Update to version 4.6.1:
  * Add ntsaeads directive to enable only selected AEAD algorithms
    for NTS.
  * Negotiate use of compliant NTS keys with AES-128-GCM-SIV AEAD
    algorithm.
  * Switch to compliant NTS keys if first response from server is
    NTS NAK.

- Drop rcFOO symlinks for CODE16 (PED-266).

- Update to version 4.6:
  * Add activate option to local directive to set activation threshold
  * Add ipv4 and ipv6 options to server/pool/peer directive
  * Add kod option to ratelimit directive for server KoD RATE support
  * Add leapseclist directive to read NIST/IERS leap-seconds.list file
  * Add ptpdomain directive to set PTP domain for NTP over PTP
  * Allow disabling pidfile
  * Improve copy server option to accept unsynchronised status instantly
  * Log one selection failure on start
  * Add offset command to modify source offset correction
  * Add timestamp sources to ntpdata report
  * Fix crash on sources reload during initstepslew or RTC initialisation
  * Fix source refreshment to not repeat failed name resolving attempts

- Update to version 4.5:
  * Add support for AES-GCM-SIV in GnuTLS
  * Add support for corrections from PTP transparent clocks
  * Add support for systemd socket activation
  * Fix presend in interleaved mode
  * Fix reloading of modified sources from sourcedir

## Which versions are affected by SUSE-SU-2025:20846-1?


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `chrony` | SUSE:Linux Micro 6.0 | All versions | 4.8-1.1 |

## How do I fix SUSE-SU-2025:20846-1?

Apply the vendor's patch.

## Is SUSE-SU-2025:20846-1 being exploited?

There is no known exploitation of SUSE-SU-2025:20846-1 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for SUSE-SU-2025:20846-1 and fix it if it is affected.

What it is: SUSE-SU-2025:20846-1 is a vulnerability in chrony, published on 14 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of SUSE-SU-2025:20846-1 in the wild and no public exploit code.

Affected product: chrony. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/SUSE-SU-2025-20846-1/ (Markdown: https://insights.sbomify.com/SUSE-SU-2025-20846-1/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/SUSE-SU-2025:20846-1

---
From sbomify Insights: https://insights.sbomify.com/SUSE-SU-2025-20846-1/
Summaries are generated and may contain mistakes; the official description above is the record.