Bug 1550218 – CVE-2018-7184 ntp: Interleaved symmetric mode cannot recover from bad state

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1550218 - (CVE-2018-7184) CVE-2018-7184 ntp: Interleaved symmetric mode cannot recover from bad state

Summary:	CVE-2018-7184 ntp: Interleaved symmetric mode cannot recover from bad state

Status:	NEW

Aliases:	CVE-2018-7184

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20180227,reported=2...
Keywords:	Security

Depends On:	1550228 1550229
Blocks:	1550226
	Show dependency tree / graph

Reported:	2018-02-28 14:41 EST by Pedro Sampaio
Modified:	2018-05-20 22:21 EDT (History)
CC List:	4 users (show)

See Also:
Fixed In Version:	ntp 4.2.8p11
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Knowledge Base (Solution)	3451911	None	None	None	2018-05-20 22:21 EDT

Groups: None (edit)

Description Pedro Sampaio 2018-02-28 14:41:17 EST

The fix for NtpBug2952 was incomplete, and while it fixed one problem it created another. Specifically, it drops bad packets before updating the "received" timestamp. This means a third-party can inject a packet with a zero-origin timestamp, meaning the sender wants to reset the association, and the transmit timestamp in this bogus packet will be saved as the most recent "received" timestamp. The real remote peer does not know this value and this will disrupt the association until the association resets.

References:

http://support.ntp.org/bin/view/Main/NtpBug3453

Comment 1 Pedro Sampaio 2018-02-28 14:51:20 EST

Created ntp tracking bugs for this issue:

Affects: fedora-all [bug 1550228]

Note You need to log in before you can comment on or make changes to this bug.