GHSA-v83q-83hj-rw38: Ntpd Denial of Service Vulnerability

MODERATE
Share
CWE-369 CWE-703
Published
Advisory Summary

GHSA-v83q-83hj-rw38 is a MODERATE denial of service vulnerability (CWE-369: Divide By Zero) affecting Ntpd libraries in the crates.io ecosystem. The issue involves ntpd nts client denial of service via wrongly sized cookies. Remediation is available by upgrading affected packages to version 1.5.0.

GHSA-v83q-83hj-rw38 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-v83q-83hj-rw38
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-369: Divide By Zero
Affected Product Ntpd
Package Ecosystem crates.io
Published Date
Last Updated

How to Fix GHSA-v83q-83hj-rw38

To remediate this vulnerability, upgrade all affected Ntpd dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

ntpd fixed: 1.5.0 
Upgrade ntpd to 1.5.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for ntpd

How to Check if You Are Affected

To determine whether your application is affected by GHSA-v83q-83hj-rw38, inspect your project dependencies for Ntpd:

inspect dependencies for ntpd

Analyze the terminal output to locate any version of Ntpd in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.5.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-369: Divide By Zero, where the product divides a value by zero. In Ntpd, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Two denial of service vulnerabilities were found in ntpd-rs related to the handling of NTS cookies in our client functionality. Whenever an NTS source is configured and the server behind that source is sending zero-sized cookies or cookies larger than what would fit in our buffer size, ntpd-rs would crash. Only configured NTS sources can abuse these vulnerabilities. NTP sources or third parties that are not configured cannot make use of these vulnerabilities. For zero-sized cookies: a division by zero would force an exit when the number of new cookies that would need to be requested is calculated. In ntpd-rs 1.5.0 a check was added to prevent the division by zero. For large cookies: while trying to send a NTP request with the cookie included, the buffer is too small to handle the cookie and an exit of ntpd-rs is forced once a write to the buffer is attempted. The memory outside the buffer would not be written to in this case. In ntpd-rs 1.5.0 a check was added that prevents accepting cookies larger than 350 bytes. Users of older versions of ntpd-rs are recommended to update to the latest version. If an update is impossible, it is recommended to only add NTS sources to ntpd-rs that are trusted to not abuse this bug.

GHSA-v83q-83hj-rw38 Affected Ntpd Versions

1 component(s)
Fixed Versions:
1.5.0
Product / Package Ecosystem Affected Versions Fixed Version
ntpd
 crates.io
< 1.5.0
1.5.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-v83q-83hj-rw38
Security Fix Commit FIX COMMIT
https://github.com/pendulum-project/ntpd-rs/commit/10a103b471dae25ac598140df0c195b6531bf716
Security Fix Commit FIX COMMIT
https://github.com/pendulum-project/ntpd-rs/commit/37dd8d9a0faa03e7dfe3a4bf64953010f075c3e2
Ntpd Source Repository REPOSITORY
https://github.com/pendulum-project/ntpd-rs

Frequently Asked Questions

What is GHSA-v83q-83hj-rw38?
GHSA-v83q-83hj-rw38 is a security vulnerability in Ntpd involving ntpd NTS client denial of service via wrongly sized cookies under CWE-369: Divide By Zero.
Which Ntpd versions are affected?
Affected versions include releases prior to 1.5.0 across affected packages: ntpd.
What version fixes GHSA-v83q-83hj-rw38?
Upgrading to 1.5.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is ntpd affected?
Yes, ntpd is affected in releases prior to 1.5.0. Upgrade your dependency to 1.5.0 or later.
What CWE is associated with GHSA-v83q-83hj-rw38?
GHSA-v83q-83hj-rw38 is classified under CWE-369: Divide By Zero (The product divides a value by zero.).
How can I check crates.io dependencies for GHSA-v83q-83hj-rw38?
Run the dependency tree command: 'inspect dependencies for ntpd'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-v83q-83hj-rw38",
  "modified" : "2025-02-28T17:46:36Z",
  "published" : "2025-02-28T17:46:36Z",
  "aliases" : [ ],
  "summary" : "ntpd NTS client denial of service via wrongly sized cookies",
  "details" : "Two denial of service vulnerabilities were found in ntpd-rs related to the handling of NTS cookies in our client functionality. Whenever an NTS source is configured and the server behind that source is sending zero-sized cookies or cookies larger than what would fit in our buffer size, ntpd-rs would crash. Only configured NTS sources can abuse these vulnerabilities. NTP sources or third parties that are not configured cannot make use of these vulnerabilities.\n\nFor zero-sized cookies: a division by zero would force an exit when the number of new cookies that would need to be requested is calculated. In ntpd-rs 1.5.0 a check was added to prevent the division by zero.\n\nFor large cookies: while trying to send a NTP request with the cookie included, the buffer is too small to handle the cookie and an exit of ntpd-rs is forced once a write to the buffer is attempted. The memory outside the buffer would not be written to in this case. In ntpd-rs 1.5.0 a check was added that prevents accepting cookies larger than 350 bytes.\n\nUsers of older versions of ntpd-rs are recommended to update to the latest version. If an update is impossible, it is recommended to only add NTS sources to ntpd-rs that are trusted to not abuse this bug.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "ntpd"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.5.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-v83q-83hj-rw38"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pendulum-project/ntpd-rs/commit/10a103b471dae25ac598140df0c195b6531bf716"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pendulum-project/ntpd-rs/commit/37dd8d9a0faa03e7dfe3a4bf64953010f075c3e2"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pendulum-project/ntpd-rs"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-369", "CWE-703" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-02-28T17:46:36Z",
    "nvd_published_at" : null
  }
}