Improper handling of NTS cookie length that could crash the ntpd-rs server

CVE-2023-33192

What is CVE-2023-33192?

The ntpd-rs NTP implementation, developed by Pendulum, is susceptible to a vulnerability due to insufficient validation of NTS cookies in incoming NTP packets. This flaw allows an attacker to craft an NTP packet with a cookie that is shorter than the expected length, thereby causing the server to crash. Additionally, the server experiences crashes when it is not configured to handle NTS packets. The root cause stems from improper slice indexing, which has since been addressed in version 0.3.3 through the adoption of safer indexing methods that effectively handle erroneous cookie lengths without resulting in server outages.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References