CVE-2024-38528 - Vulnerability Details - OpenCVE

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. This allows an unauthenticated remote attacker to crash ntpd-rs when an NTS-KE server is configured. Non NTS-KE server configurations, such as the default ntpd-rs configuration, are unaffected. This vulnerability has been patched in version 1.1.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-2xpx-vcmq-5f72

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-06-28T19:28:34.664Z

Updated: 2024-08-02T04:12:25.343Z

Reserved: 2024-06-18T16:37:02.728Z

Link: CVE-2024-38528

Vulnrichment

Updated: 2024-08-02T04:12:25.343Z

NVD

Status : Awaiting Analysis

Published: 2024-06-28T20:15:02.533

Modified: 2024-11-21T09:26:12.193

Link: CVE-2024-38528

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-38528", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-06-18T16:37:02.728Z", "datePublished": "2024-06-28T19:28:34.664Z", "dateUpdated": "2024-08-02T04:12:25.343Z"}, "containers": {"cna": {"title": "Unlimited number of NTS-KE connections can crash ntpd-rs server", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-2xpx-vcmq-5f72", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-2xpx-vcmq-5f72"}], "affected": [{"vendor": "pendulum-project", "product": "ntpd-rs", "versions": [{"version": ">= 0.3.1, <= 1.1.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-28T19:28:34.664Z"}, "descriptions": [{"lang": "en", "value": "nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. This allows an unauthenticated remote attacker to crash ntpd-rs when an NTS-KE server is configured. Non NTS-KE server configurations, such as the default ntpd-rs configuration, are unaffected. This vulnerability has been patched in version 1.1.3.\n"}], "source": {"advisory": "GHSA-2xpx-vcmq-5f72", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "tweedegolf", "product": "ntpd-rs", "cpes": ["cpe:2.3:a:tweedegolf:ntpd-rs:0.3.1:*:*:*:*:rust:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0.3.1", "status": "affected", "lessThanOrEqual": "1.1.2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-01T17:42:24.718924Z", "id": "CVE-2024-38528", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-01T17:42:28.026Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:25.343Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-2xpx-vcmq-5f72", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-2xpx-vcmq-5f72"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-2xpx-vcmq-5f72", "name": "https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-2xpx-vcmq-5f72", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:25.343Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-38528", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-01T17:42:24.718924Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:tweedegolf:ntpd-rs:0.3.1:*:*:*:*:rust:*:*"], "vendor": "tweedegolf", "product": "ntpd-rs", "versions": [{"status": "affected", "version": "0.3.1", "versionType": "custom", "lessThanOrEqual": "1.1.2"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-01T17:42:15.162Z"}}], "cna": {"title": "Unlimited number of NTS-KE connections can crash ntpd-rs server", "source": {"advisory": "GHSA-2xpx-vcmq-5f72", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "pendulum-project", "product": "ntpd-rs", "versions": [{"status": "affected", "version": ">= 0.3.1, <= 1.1.2"}]}], "references": [{"url": "https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-2xpx-vcmq-5f72", "name": "https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-2xpx-vcmq-5f72", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. This allows an unauthenticated remote attacker to crash ntpd-rs when an NTS-KE server is configured. Non NTS-KE server configurations, such as the default ntpd-rs configuration, are unaffected. This vulnerability has been patched in version 1.1.3.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-28T19:28:34.664Z"}}}, "cveMetadata": {"cveId": "CVE-2024-38528", "state": "PUBLISHED", "dateUpdated": "2024-08-02T04:12:25.343Z", "dateReserved": "2024-06-18T16:37:02.728Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-06-28T19:28:34.664Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}