CVE-2024-38528: 
Rust vulnerability analysis and mitigation

ntpd-rs, a tool for synchronizing computer clocks implementing NTP and NTS protocols, contains a vulnerability identified as CVE-2024-38528. The vulnerability stems from a missing limit for accepted NTS-KE connections, discovered and disclosed on June 28, 2024. This security flaw affects ntpd-rs versions up to 1.1.2 (from version 0.3.1) when configured as an NTS-KE server. The default ntpd-rs configuration and non-NTS-KE server configurations are not affected (GitHub Advisory).

The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). Operating systems have a limit for the number of open file descriptors (including sockets) in a single process, typically 1024 on Linux by default. When ntpd-rs is configured as an NTS server, it accepts TCP connections for the NTS-KE service without implementing proper connection limits. The vulnerability has received a CVSS v3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (GitHub Advisory).

When exploited, this vulnerability allows an unauthenticated remote attacker to crash the ntpd-rs daemon when an NTS-KE server is configured. If the process reaches the descriptor limit and attempts to accept a new TCP connection, the accept() system call returns with an EMFILE error, causing ntpd-rs to abort. In cases where ntpd-rs is automatically restarted, an attacker can repeat the attack to prevent the service from functioning effectively (GitHub Advisory).

The vulnerability can be exploited by opening a large number of parallel TCP connections to the server quickly enough to avoid the key-exchange-timeout-ms timeout (default 1000 milliseconds). The attack requires no authentication or special privileges, making it relatively straightforward to execute (GitHub Advisory).

The vulnerability has been patched in version 1.1.3. For users unable to update immediately, several workarounds are available: disable NTS-KE server functionality, increase system resource limits (RLIMIT_NOFILE) to make the attack more difficult, or lower the key-exchange-timeout-ms configuration setting. Non NTS-KE server configurations, such as the default ntpd-rs configuration, are inherently unaffected (GitHub Advisory).