Upstream has issued an advisory today (June 23): http://support.ntp.org/bin/view/Main/SecurityNotice#June_2020_ntp_4_2_8p15_NTP_Relea http://support.ntp.org/bin/view/Main/NtpBug3661 The issue has been fixed in 4.2.8p15. Mageia 7 is also affected.
Whiteboard: (none) => MGA7TOOStatus comment: (none) => Fixed upstream in 4.2.8p15
Assigning to NicolasS as having done the most recent updates to this SRPM (which has no registered maintainer).
Assignee: bugsquad => nicolas.salguero
Suggested advisory: ======================== The updated packages fix a security vulnerability: Memory leak with CMAC keys. References: http://support.ntp.org/bin/view/Main/SecurityNotice#June_2020_ntp_4_2_8p15_NTP_Relea http://support.ntp.org/bin/view/Main/NtpBug3661 ======================== Updated packages in core/updates_testing: ======================== ntp-4.2.8p15-1.mga7 ntp-perl-4.2.8p15-1.mga7.noarch.rpm ntpdate-4.2.8p15-1.mga7 sntp-4.2.8p15-1.mga7 ntp-doc-4.2.8p15-1.mga7 from SRPMS: ntp-4.2.8p15-1.mga7.src.rpm
Status: NEW => ASSIGNEDWhiteboard: MGA7TOO => (none)Assignee: nicolas.salguero => qa-bugsStatus comment: Fixed upstream in 4.2.8p15 => (none)Version: Cauldron => 7
mga7, x86_64 Before updates ntpd was available but not running. Installed the packages which were missing then updated from testing. Restarted the server then: $ sudo systemctl status ntpd ● ntpd.service - Network Time Service Loaded: loaded (/usr/lib/systemd/system/ntpd.service; disabled; vendor prese> Active: active (running) since Fri 2020-06-26 12:20:04 BST; 12s ago Process: 5887 ExecStart=/usr/sbin/ntpd -u ntp:ntp $OPTIONS (code=exited, stat> Main PID: 5889 (ntpd) Memory: 1.4M CGroup: /system.slice/ntpd.service └─5889 /usr/sbin/ntpd -u ntp:ntp -g Jun 26 12:20:04 difda ntpd[5889]: Listen and drop on 1 v4wildcard 0.0.0.0:123 Jun 26 12:20:04 difda ntpd[5889]: Listen normally on 2 lo 127.0.0.1:123 Jun 26 12:20:04 difda ntpd[5889]: Listen normally on 3 enp3s0 192.168.1.103:123 Jun 26 12:20:04 difda ntpd[5889]: Listen normally on 4 lo [::1]:123 Jun 26 12:20:04 difda ntpd[5889]: Listen normally on 5 enp3s0 [fe80::dacb:8aff:> Jun 26 12:20:04 difda ntpd[5889]: Listening on routing socket on fd #22 for int> Jun 26 12:20:04 difda ntpd[5889]: kernel reports TIME_ERROR: 0x41: Clock Unsync> Jun 26 12:20:04 difda ntpd[5889]: kernel reports TIME_ERROR: 0x41: Clock Unsync> Jun 26 12:20:04 difda systemd[1]: Started Network Time Service. Jun 26 12:20:05 difda ntpd[5889]: Soliciting pool server 185.53.93.157 Used mcc to check the time and assign a pool server. Restarted ntpd and observed that the pool server had changed: ... Jun 26 12:40:04 difda systemd[1]: Started Network Time Service. Jun 26 12:40:06 difda ntpd[9317]: Soliciting pool server 81.21.65.168 $ nslookup 81.21.65.168 168.65.21.81.in-addr.arpa canonical name = 168.128-255.65.21.81.in-addr.arpa. 168.128-255.65.21.81.in-addr.arpa name = ns3.turbodns.co.uk. Could not get the hang of sntp. Ran it at the cli to change the polling interval but it kept falling over on hostname. Apart from that the service works fine.
Whiteboard: (none) => MGA7-64-OKCC: (none) => tarazed25
Validating. Advisory in Comment 2.
CC: (none) => andrewsfarm, sysadmin-bugsKeywords: (none) => validated_update
SUSE has issued an advisory for this on June 30. It has a CVE. Suggested advisory: ======================== Updated ntp packages fix security vulnerability: ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file (CVE-2020-15025). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15025 http://support.ntp.org/bin/view/Main/NtpBug3661 http://support.ntp.org/bin/view/Main/SecurityNotice#June_2020_ntp_4_2_8p15_NTP_Relea https://lists.suse.com/pipermail/sle-security-updates/2020-June/007056.html
Summary: ntp new security issue fixed upstream in 4.2.8p15 => ntp new security issue fixed upstream in 4.2.8p15 (CVE-2020-15025)
CC: (none) => mageiaKeywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2020-0281.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED
openSUSE claims this fixed CVE-2018-8956 as well: https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html