CVE-2024-50195

What it actually does

Missing validation of timespec64 tv_sec and tv_nsec ranges in pc_clock_settime allows invalid values to reach PTP driver settime64 callbacks, enabling direct hardware register writes without sanitization in drivers such as hclge_ptp_settime and igb_ptp_settime_i210.

Why it matters to the business

Time synchronization for PTP-dependent systems can fail or become unstable, disrupting operations that rely on precise clock hardware in networking and industrial environments.

How an attack unfolds

An attacker with clock-setting privileges supplies a timespec64 containing negative seconds or out-of-range nanoseconds to pc_clock_settime; the absent strict validity check passes the malformed value to driver callbacks that write it directly to registers, producing undefined hardware behavior.

How to fix it

Upgrade the Linux kernel to a version containing commit 29f085345cde24566efb751f39e5d367c381c584; for systemd on Ubuntu 16.04 LTS apply package version 229-4ubuntu4 or newer.

How to confirm the fix worked

Confirm presence of timespec64_valid_strict call and EINVAL return path inside pc_clock_settime; test the interface with negative seconds and out-of-range nanoseconds to verify rejection.

Typical attack path

1. Locate systems exposing PTP clocks
2. Obtain privileges required to invoke clock_settime on dynamic clocks
3. Construct timespec64 with invalid tv_sec or tv_nsec
4. Call pc_clock_settime with the crafted value
5. Observe or trigger driver register writes

How to detect it

Inspect kernel logs and PTP driver traces for clock_settime calls that previously would have been accepted but now produce EINVAL; look for hardware register anomalies or time jumps in PTP-enabled network interfaces.

What your security team should do

• Apply the referenced kernel and package fixes without delay
• Review all PTP clock usage and driver implementations for local checks that can now be removed
• Monitor time synchronization services for anomalies after patching