Chrony Memory Corruption Vulnerability (CVE-2015-1822)

Chrony Memory Corruption Vulnerability (CVE-2015-1822)
Chrony Memory Corruption Vulnerability (CVE-2015-1822)

Release date:
Updated on:

Affected Systems:

Chrony

Description:

CVE (CAN) ID: CVE-2015-1822

Chrony is a tool used for computer time synchronization. It implements the NTP protocol and can be used as both a client and a server program. Chrony is especially suitable for maintaining computer time accuracy in a non-network connection environment.

Chrony has Uninitialized pointers in the cmdmon reply slot. authenticated attackers can use other commands to allocate or unallocate memory and forcibly allocate new reply slots so that chronyd can write and reply to invalid memory.

<* Source: Miroslav Lichv ár
*>

Suggestion:

Vendor patch:

Chrony
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://chrony.tuxfamily.org/News.html

Http://download.tuxfamily.org/chrony/chrony-1.31.1.tar.gz

This article permanently updates the link address: