Bug 1434005 (CVE-2017-6458) - CVE-2017-6458 ntp: Potential Overflows in ctl_put() functions
Summary: CVE-2017-6458 ntp: Potential Overflows in ctl_put() functions
Status: CLOSED NOTABUG
Alias: CVE-2017-6458
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20170321,reported=2...
Keywords: Security
Depends On: 1435163
Blocks: 1434021
TreeView+ depends on / blocked
 
Reported: 2017-03-20 14:15 UTC by Adam Mariš
Modified: 2017-03-30 06:08 UTC (History)
6 users (show)

(edit)
A vulnerability was found in NTP, in the building of response packets with custom fields. If custom fields were configured in ntp.conf with particularly long names, inclusion of these fields in the response packet could cause a buffer overflow, leading to a crash.
Clone Of:
(edit)
Last Closed: 2017-03-30 06:08:16 UTC


Attachments (Terms of Use)

Description Adam Mariš 2017-03-20 14:15:30 UTC
ntpd makes use of different wrappers around ctl_putdata() to create name/value ntpq (mode 6) response strings. For example, ctl_putstr() is usually used to send string data (variable names or string data).  The formatting code was missing a length check for variable names. If somebody explicitly created any unusually long variable names in ntpd (longer than 200-512 bytes, depending on the type of variable), then if any of these variables are added to the response list it would overflow a buffer.

Mitigation:

Implement BCP-38.

If you don't want to upgrade, then don't setvar variable names longer than 200-512 bytes in your ntp.conf file.

Properly monitor your ntpd instances, and auto-restart ntpd (without -g) if it stops running.

Comment 1 Adam Mariš 2017-03-20 14:15:36 UTC
Acknowledgments:

Name: the NTP project
Upstream: Cure53

Comment 5 Adam Mariš 2017-03-23 10:08:41 UTC
Created ntp tracking bugs for this issue:

Affects: fedora-all [bug 1435163]

Comment 7 Doran Moppert 2017-03-30 05:59:42 UTC
Statement:

The security assessment from cure53 clarifies that this issue (identified as NTP-01-0004) is not a vulnerability per se, but a weakness in ntp's internal coding style that may cause a vulnerability if particularly long variable names are defined at compile time. No such variable names are defined in upstream source code, nor in Fedora or Red Hat Enterprise Linux versions of ntp.


Note You need to log in before you can comment on or make changes to this bug.