CVE-2024-38528

HIGH

ntpd-rs 0.3.1-1.1.2 - Unauthenticated Denial of Service via NTS-KE Connection Flood

Title source: llm
STIX 2.1

Description

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. This allows an unauthenticated remote attacker to crash ntpd-rs when an NTS-KE server is configured. Non NTS-KE server configurations, such as the default ntpd-rs configuration, are unaffected. This vulnerability has been patched in version 1.1.3.

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.0072
EPSS Percentile 48.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-770
Status published
Products (2)
crates.io/ntpd 0.3.1 - 1.1.3crates.io
pendulum-project/ntpd-rs >= 0.3.1, <= 1.1.2
Published Jun 28, 2024
Tracked Since Feb 18, 2026