CVE-2015-1822 chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitial...
MediumCVSS 6.5
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/chrony(Debian:12) | < 1.30-2 | 1.30-2 |
| debian/chrony(Debian:13) | < 1.30-2 | 1.30-2 |
| debian/chrony(Debian:14) | < 1.30-2 | 1.30-2 |
| debian linux | = 7.0 | No fix listed |
| tuxfamily chrony | <= 1.31 | No fix listed |
References
- Debian Security Tracker CVE-2015-1822 vendor-advisory
- [chrony-announce] 20150407 chrony-1.31.1 released (security) mailing-list patch vendor-advisory
- DSA-3222 vendor-advisory
- www.oracle.com
- 73956 vdb-entry
- GLSA-201507-01 vendor-advisory
- bugs.debian.org issue-tracking