Bug 1434011 (CVE-2017-6451) - CVE-2017-6451 ntp: Improper use of snprintf() in mx4200_send()
Summary: CVE-2017-6451 ntp: Improper use of snprintf() in mx4200_send()
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2017-6451
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1435163
Blocks: 1434021
TreeView+ depends on / blocked
 
Reported: 2017-03-20 14:29 UTC by Adam Mariš
Modified: 2019-09-29 14:08 UTC (History)
5 users (show)

Fixed In Version: ntp 4.2.8p10
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in NTP, in the legacy MX4200 refclock implementation. If this refclock was compiled in and used, an attacker may be able to induce stack overflow, leading to a crash or potential code execution.
Clone Of:
Environment:
Last Closed: 2017-03-31 01:16:57 UTC


Attachments (Terms of Use)

Description Adam Mariš 2017-03-20 14:29:53 UTC
The legacy MX4200 refclock is only built if it is specifically enabled, and furthermore additional code changes are required to compile and use it. But it uses the libc functions snprintf() and vsnprintf() incorrectly, which can lead to an out-of-bounds memory write due to an improper handling of the return value of snprintf()/vsnprintf(). Since the return value is used as an iterator and it can be larger than the buffer's size, it is possible for the iterator to point somewhere outside of the allocated buffer space.  This results in an out-of-bound memory write. This behavior can be leveraged to overwrite a saved instruction pointer on the stack and gain control over the execution flow.

During testing it was not possible to identify any malicious usage for this vulnerability. Specifically, no way for an attacker to exploit this vulnerability was ultimately unveiled. However, it has the potential to be exploited, so the code should be fixed.

Mitigation:

Properly monitor your ntpd instances, and auto-restart ntpd (without -g) if it stops running.

Comment 1 Adam Mariš 2017-03-20 14:29:58 UTC
Acknowledgments:

Name: the NTP project
Upstream: Cure53

Comment 2 Doran Moppert 2017-03-21 06:06:38 UTC
NTP on Red Hat Enterprise Linux 5 through 7 is built with the MX4200 refclock disabled.

Comment 4 Adam Mariš 2017-03-23 10:08:50 UTC
Created ntp tracking bugs for this issue:

Affects: fedora-all [bug 1435163]


Note You need to log in before you can comment on or make changes to this bug.