Bug 2565815 (CVE-2026-121505)
| Summary: | CVE-2026-121505 ntpsec: ntpsec: Information disclosure via malformed NTS-KE response record | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in NTPsec. A malicious Network Time Security Key Exchange (NTS-KE) server can cause information disclosure by sending a response record with a declared length exceeding the data received. This triggers an out-of-bounds read in the client response parser, allowing the server to retrieve sensitive stack memory, such as internal pointers that weaken Address Space Layout Randomization (ASLR), which the client sends back in cleartext.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-03 14:36:56 UTC
|