Out-of-Bounds Read in NTPsec ntpd

Executive Summary

This vulnerability is an out-of-bounds read flaw in the Motorola Oncore refclock driver of NTPsec ntpd versions before 1.2.6. It occurs when an attacker controlling a GPS receiver's serial data sends a PPS Control reply with an out-of-range mode byte. The issue stems from an unchecked user-provided byte used as an array index, leading to potential memory disclosure or ntpd crashes.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the version of NTPsec ntpd and inspecting the refclock_oncore.c file for the unpatched code. Commands to check the version include 'ntpd --version' or examining package managers like 'apt list --installed | grep ntpsec' or 'rpm -qa | grep ntpsec'. Review the source code for the oncore_msg_Gc function in ntpd/refclock_oncore.c to confirm if bounds checking is missing.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to crash the ntpd service or access sensitive memory contents. This may disrupt time synchronization services, leading to potential system instability or incorrect timestamps. The impact is limited to systems using the affected Motorola Oncore refclock driver.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves an out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd, which is unrelated to data protection or privacy controls required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update NTPsec ntpd to version 1.2.6 or later. If updating is not possible, apply the patch from the NTPsec GitLab commit (22a09b3aec58831a9e4a008f3f22caa155f969c2) to add bounds checking in the oncore_msg_Gc function. Disable the Motorola Oncore refclock driver if not required.

Useful 0 Not Useful 0