CVE-2023-33192 - CVE House
Back to Database
Status published High CVE-2023-33192

Improper handling of NTS cookie length that could crash the ntpd-rs server

Vulnerability Description

ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes when it is not configured to handle NTS packets. The issue was caused by improper slice indexing. The indexing operations were replaced by safer alternatives that do not crash the ntpd-rs server process but instead properly handle the error condition. A patch was released in version 0.3.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-33192

Credits & Attribution

No credits recorded in the NVD database.

References

More from pendulum-project

View All →
CVE-2025-58066
DoS Vulnerability in ntpd-rs
Medium 5.3
CVE-2024-38528
Unlimited number of NTS-KE connections can crash ntpd-rs server
High 7.5

Affected Vendor

pendulum-project

View all reports →

Affected Software

ntpd-rs
Vulnerable Versions:
>= 0.3.0, < 0.3.3

Timeline

Official Publish: May 27th, 2023
Last Modified: January 14th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-130

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.