CVE-2023-33192
📋 TL;DR
CVE-2023-33192 is a denial-of-service vulnerability in ntpd-rs where improper validation of NTS cookie length allows attackers to crash the server with specially crafted NTP packets. The server also crashes when receiving NTS packets without proper NTS configuration. All ntpd-rs users running vulnerable versions are affected.
💻 Affected Systems
- ntpd-rs
📦 What is this software?
Ntpd Rs by Tweedegolf
⚠️ Risk & Real-World Impact
Worst Case
Complete NTP service disruption causing time synchronization failures across dependent systems and services
Likely Case
NTP service crashes requiring manual restart, causing temporary time synchronization issues
If Mitigated
Minimal impact with proper error handling and monitoring in patched versions
🎯 Exploit Status
Simple packet crafting required, no authentication needed, making exploitation trivial
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.3.3
Vendor Advisory: https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-qwhm-h7v3-mrjx
Restart Required: Yes
Instructions:
1. Stop ntpd-rs service. 2. Update to version 0.3.3 or later using package manager or source compilation. 3. Restart ntpd-rs service.
🔧 Temporary Workarounds
Network filtering
allBlock NTP packets with NTS extensions at network perimeter
Disable NTS support
allConfigure ntpd-rs to reject NTS packets entirely
Edit ntpd-rs configuration to remove NTS keys and disable NTS server functionality
🧯 If You Can't Patch
- Implement network ACLs to restrict NTP traffic to trusted sources only
- Deploy monitoring and automated restart scripts for ntpd-rs service
🔍 How to Verify
Check if Vulnerable:
Check ntpd-rs version: if version < 0.3.3, system is vulnerableCheck Version:
ntp-daemon --version or check package manager (apt list ntpd-rs, yum list ntpd-rs, etc.)Verify Fix Applied:
Confirm ntpd-rs version is 0.3.3 or later and service is running without crashes📡 Detection & Monitoring
Log Indicators:
- ntpd-rs process crashes
- segmentation fault errors in system logs
- NTP service restart messages
Network Indicators:
- Unusual NTP packets with malformed NTS extensions
- NTP packets with short cookie fields
SIEM Query:
source="ntpd-rs" AND ("segmentation fault" OR "panic" OR "crash")