CVE-2023-33192 — Improper Handling of Length Parameter Inconsistency in Ntpd-rs

CWE-130 — Improper Handling of Length Parameter Inconsistency3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 50.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Tweedegolf Ntpd-rsDave Mills NtpdPendulum-project Ntpd-rs
Timeline
Latest updateMay 25
PublishedMay 27

Description

ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes when it is not configured to handle NTS packets. The issue was caused by improper slice indexing. The indexing operations were replaced by safer alternatives that do not crash the ntpd-rs server process…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶crates.iodave_mills/ntpd0.3.0 — 0.3.3
▶NVDtweedegolf/ntpd-rs0.3.0 — 0.3.3
▶CVEListV5pendulum-project/ntpd-rs>= 0.3.0, < 0.3.3

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
OSV
Improper handling of NTS cookie length that could crash the ntpd-rs server↗2023-05-25
▶
GHSA
Improper handling of NTS cookie length that could crash the ntpd-rs server↗2023-05-25
▶