Cloudanix VulnDB

CVE-2024-38528

High · 7.5

CVSS

7.5

EPSS

0.7%

Published

Jun 28, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A clock synchronization program can be knocked offline by an attacker sending too many connection requests when an optional security feature is turned on.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Missing limit on accepted NTS-KE connections allows an unauthenticated remote attacker to open unlimited connections, exhausting resources and crashing the ntpd-rs process when NTS-KE is enabled.

Why it matters to the business

Disruption of time synchronization services in environments using the NTS-KE feature can cause operational failures in systems that depend on accurate clock synchronization.

How an attack unfolds

An attacker identifies a reachable ntpd-rs instance with NTS-KE enabled and floods it with NTS-KE connection requests, triggering resource exhaustion and an immediate crash of the daemon.

How to fix it

Upgrade ntpd-rs to version 1.1.3 or later to enforce connection limits; disable NTS-KE if the feature is not required.

How to confirm the fix worked

Confirm the running binary reports version 1.1.3 or newer; perform load testing with multiple NTS-KE connections to verify the limit is enforced and no crash occurs.

Typical attack path

  1. Locate ntpd-rs instances exposing NTS-KE on the network
  2. Establish a high volume of NTS-KE connections without authentication
  3. Trigger process termination via resource exhaustion

How to detect it

Review ntpd-rs logs and system process logs for sudden terminations preceded by a large number of NTS-KE connection attempts; correlate with network flow data showing spikes in connections to the NTS-KE port.

What your security team should do

  • Upgrade to ntpd-rs 1.1.3 immediately where NTS-KE is enabled
  • Disable NTS-KE unless explicitly required
  • Add network-level rate limiting for NTS-KE ports as a compensating control

The record

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. This allows an unauthenticated remote attacker to crash ntpd-rs when an NTS-KE server is configured. Non NTS-KE server configurations, such as the default ntpd-rs configuration, are unaffected. This vulnerability has been patched in version 1.1.3.

Affected packages

Ecosystem Package Introduced Fixed
crates.io ntpd 0.3.1 1.1.3
Debian:13 rust-ntpd 0 1.1.3-1
SUSE:Package Hub 15 SP5 ntpd-rs 0 1.2.3-bp155.2.1
SUSE:Package Hub 15 SP6 ntpd-rs 0 1.2.3-bp156.2.1
Ubuntu:24.04:LTS rust-ntpd 0 No fix
Ubuntu:24.10 rust-ntpd 0 No fix
cargo ntpd 0.3.1 1.1.3
openSUSE:Leap 15.5 ntpd-rs 0 1.2.3-bp155.2.1
openSUSE:Leap 15.6 ntpd-rs 0 1.2.3-bp156.2.1
openSUSE:Tumbleweed ntpd-rs 0 1.2.0-1.1

Related vulnerabilities