Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-33192

CVE-2023-33192: Improper handling of NTS cookie length that could crash the ntpd-rs server

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-33192
GHSA ID
GHSA-qwhm-h7v3-mrjx
EPSS Score
0.41979%
CWE
CWE-130
Published
5/25/2023
Updated
11/4/2023
KEV Status
No
Technology
TechnologyRust

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
ntpdrust>= 0.3.0, < 0.3.30.3.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper slice indexing during NTS cookie processing. The patch replaced direct slicing with safe methods (like get() instead of []), indicating the original code accessed cookie data without proper bounds checks. The server crash occurs in NTS packet handling, pointing to functions in the NTS key server and packet decoding logic. The high confidence comes from: 1) Explicit mention of slice indexing fixes in the patch description 2) Server-specific impact aligning with key server components 3) Cookie decoding being the primary attack vector mentioned in CWE-130 context.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t ntp*-rs *o*s not v*li**t* t** l*n*t* o* NTS *ooki*s in r***iv** NTP p**k*ts to t** s*rv*r. *n *tt**k*r **n *r*s* t** s*rv*r *y s*n*in* * sp**i*lly *r**t** NTP p**k*t *ont*inin* * *ooki* s*ort*r t**n w**t t** s*rv*r *xp**ts. T** s*rv*r *lso

Reasoning

T** vuln*r**ility st*ms *rom improp*r sli** in**xin* *urin* NTS *ooki* pro**ssin*. T** p*t** r*pl**** *ir**t sli*in* wit* s*** m*t*o*s (lik* `**t()` inst*** o* []), in*i**tin* t** ori*in*l *o** ****ss** *ooki* **t* wit*out prop*r *oun*s ****ks. T** s