Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Chrony before 1.23.1 can run out of memory and stop

CVE-2010-0293 · published 16 years ago
Summary

The time‑synchronisation service called Chrony stores information about client requests without a limit. An attacker can send forged network packets that make Chrony use all available memory, causing the service to freeze or crash. Update Chrony to version 1.23.1 or later to protect against this.

What to do
  • Update debian chrony to version 1.23-7.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian chrony < 1.23-7
Fix: upgrade to 1.23-7
Debian:13 debian chrony < 1.23-7
Fix: upgrade to 1.23-7
Debian:14 debian chrony < 1.23-7
Fix: upgrade to 1.23-7
– tuxfamily chrony <= 1.23-pre1
1.18
1.19
1.19-1
1.19.99.1
1.19.99.2
1.19.99.3
1.20
1.21
1.21-pre1
1.24-pre1
cpe:2.3:a:tuxfamily:chrony:*:*:*:*:*:*:*:*
Original advisory text
The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information, which allows remote attackers to cause a denial of...
The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information, which allows remote attackers to cause a denial of service (memory consumption) via spoofed (1) NTP or (2) cmdmon packets.
References
Severity
5.0 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-399Resource Management Errors
Timeline
Published8 Feb 2010
Updated30 Oct 2026
First seen4 Sep 2026
Sources
DEBIAN-CVE-2010-0293 · OSV
CVE-2010-0293 · NVD
Track software like this
Free during beta