Bug 1434011 (CVE-2017-6451)

Summary: CVE-2017-6451 ntp: Improper use of snprintf() in mx4200_send()
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: apmukher, linville, mlichvar, sardella, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: ntp 4.2.8p10 Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in NTP, in the legacy MX4200 refclock implementation. If this refclock was compiled in and used, an attacker may be able to induce stack overflow, leading to a crash or potential code execution.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2017-03-31 01:16:57 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1435163    
Bug Blocks: 1434021    

Description Adam Mariš 2017-03-20 14:29:53 UTC 
The legacy MX4200 refclock is only built if it is specifically enabled, and furthermore additional code changes are required to compile and use it. But it uses the libc functions snprintf() and vsnprintf() incorrectly, which can lead to an out-of-bounds memory write due to an improper handling of the return value of snprintf()/vsnprintf(). Since the return value is used as an iterator and it can be larger than the buffer's size, it is possible for the iterator to point somewhere outside of the allocated buffer space.  This results in an out-of-bound memory write. This behavior can be leveraged to overwrite a saved instruction pointer on the stack and gain control over the execution flow.

During testing it was not possible to identify any malicious usage for this vulnerability. Specifically, no way for an attacker to exploit this vulnerability was ultimately unveiled. However, it has the potential to be exploited, so the code should be fixed.

Mitigation:

Properly monitor your ntpd instances, and auto-restart ntpd (without -g) if it stops running.
Comment 1 Adam Mariš 2017-03-20 14:29:58 UTC 
Acknowledgments:

Name: the NTP project
Upstream: Cure53
Comment 2 Doran Moppert 2017-03-21 06:06:38 UTC 
NTP on Red Hat Enterprise Linux 5 through 7 is built with the MX4200 refclock disabled.
Comment 4 Adam Mariš 2017-03-23 10:08:50 UTC 
Created ntp tracking bugs for this issue:

Affects: fedora-all [bug 1435163]