CVE-2024-38528: pendulum-project ntpd-rs, отказ на услуга

Описание

Оригинално описание

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. This allows an unauthenticated remote attacker to crash ntpd-rs when an NTS-KE server is configured. Non NTS-KE server configurations, such as the default ntpd-rs configuration, are unaffected. This vulnerability has been patched in version 1.1.3.

Засегнати продукти

• pendulum-project ntpd-rs: >= 0.3.1, <= 1.1.2
• tweedegolf ntpd-rs: 0.3.1 до 1.1.2

Вид слабост

• CWE-770 Allocation of Resources Without Limits or Throttling

История

Други уязвимости в pendulum-project ntpd-rs

• 6.9CVE-2026-26076
• 5.3CVE-2025-58066
• 7.5CVE-2023-33192

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-38528
• https://nvd.nist.gov/vuln/detail/CVE-2024-38528
• https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-2xpx-vcmq-5f72