Out of Bounds Slice index in cfnts leads to remote panic

CVE-2023-3036

What is CVE-2023-3036?

Cloudflare's NTP server software presents a vulnerability that allows an attacker to exploit an unchecked read in the system. By sending a specially crafted NTSAuthenticator packet with an extension length exceeding the actual packet contents, a remote attacker can induce a server panic. This flaw, which affects versions of the software prior to commit 783490b, highlights critical weaknesses in input validation that could compromise server stability and reliability. It is essential for administrators to apply the necessary updates to mitigate potential risks associated with this vulnerability.

References