CVE-2020-14367

A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as the root user, and when it's opened for writing, chronyd does not check for an existing symbolic link with the same file name. This flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing to any destination file in the system, resulting in data loss and a denial of service due to the path traversal.

A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as the root user, and when it's opened for writing, chronyd does not check for an existing symbolic link with the same file name. This flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing to any destination file in the system, resulting in data loss and a denial of service due to the path traversal.

A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as the root user, and when it's opened for writing, chronyd does not check for an existing symbolic link with the same file name. This flaw allows an attacker with privileged access to create a symlink with the default PID file name pointing to any destination file in the system, resulting in data loss and a denial of service due to the path traversal.

Chrony's method of opening its PID file could allow a compromised chrony user account to overwrite files in certain parts of the filesystem with chrony's PID, using a symlink attack (CVE-2020-14367).

This update for chrony fixes the following issues:

Chrony was updated to 4.1, bringing features and bugfixes.

Update to 4.1

• Add support for NTS servers specified by IP address (matching Subject Alternative Name in server certificate)
• Add source-specific configuration of trusted certificates
• Allow multiple files and directories with trusted certificates
• Allow multiple pairs of server keys and certificates
• Add copy option to server/pool directive
• Increase PPS lock limit to 40% of pulse interval
• Perform source selection immediately after loading dump files
• Reload dump files for addresses negotiated by NTS-KE server
• Update seccomp filter and add less restrictive level
• Restart ongoing name resolution on online command
• Fix dump files to not include uncorrected offset
• Fix initstepslew to accept time from own NTP clients
• Reset NTP address and port when no longer negotiated by NTS-KE server

• Ensure the correct pool packages are installed for openSUSE and SLE (bsc#1180689).

• Fix pool package dependencies, so that SLE prefers chrony-pool-suse over chrony-pool-empty. (bsc#1194229)

• Enable syscallfilter unconditionally [bsc#1181826].

Update to 4.0

• Enhancements

  • Add support for Network Time Security (NTS) authentication
  • Add support for AES-CMAC keys (AES128, AES256) with Nettle
  • Add authselectmode directive to control selection of unauthenticated sources
  • Add binddevice, bindacqdevice, bindcmddevice directives
  • Add confdir directive to better support fragmented configuration
  • Add sourcedir directive and 'reload sources' command to support dynamic NTP sources specified in files
  • Add clockprecision directive
  • Add dscp directive to set Differentiated Services Code Point (DSCP)
  • Add -L option to limit log messages by severity
  • Add -p option to print whole configuration with included files
  • Add -U option to allow start under non-root user
  • Allow maxsamples to be set to 1 for faster update with -q/-Q option
  • Avoid replacing NTP sources with sources that have unreachable address
  • Improve pools to repeat name resolution to get 'maxsources' sources
  • Improve source selection with trusted sources
  • Improve NTP loop test to prevent synchronisation to itself
  • Repeat iburst when NTP source is switched from offline state to online
  • Update clock synchronisation status and leap status more frequently
  • Update seccomp filter
  • Add 'add pool' command
  • Add 'reset sources' command to drop all measurements
  • Add authdata command to print details about NTP authentication
  • Add selectdata command to print details about source selection
  • Add -N option and sourcename command to print original names of sources
  • Add -a option to some commands to print also unresolved sources
  • Add -k, -p, -r options to clients command to select, limit, reset data

• Bug fixes

  • Don’t set interface for NTP responses to allow asymmetric routing
  • Handle RTCs that don’t support interrupts
  • Respond to command requests with correct address on multihomed hosts

• Removed features

  • Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  • Drop support for long (non-standard) MACs in NTPv4 packets (chrony 2.x clients using non-MD5/SHA1 keys need to use option 'version 3')
  • Drop support for line editing with GNU Readline

• By default we don't write log files but log to journald, so only recommend logrotate.

• Adjust and rename the sysconfig file, so that it matches the expectations of chronyd.service (bsc#1173277).

Update to 3.5.1:

• Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)

• Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)

• Use iburst in the default pool statements to speed up initial …

These are all security issues fixed in the chrony-4.1-5.2 package on the GA media of openSUSE Tumbleweed.

This update for chrony fixes the following issues:

Chrony was updated to 4.1:

• Add support for NTS servers specified by IP address (matching Subject Alternative Name in server certificate)
• Add source-specific configuration of trusted certificates
• Allow multiple files and directories with trusted certificates
• Allow multiple pairs of server keys and certificates
• Add copy option to server/pool directive
• Increase PPS lock limit to 40% of pulse interval
• Perform source selection immediately after loading dump files
• Reload dump files for addresses negotiated by NTS-KE server
• Update seccomp filter and add less restrictive level
• Restart ongoing name resolution on online command
• Fix dump files to not include uncorrected offset
• Fix initstepslew to accept time from own NTP clients
• Reset NTP address and port when no longer negotiated by NTS-KE server

• Update clknetsim to snapshot f89702d.

• Ensure the correct pool packages are installed for openSUSE and SLE (bsc#1180689).

• Enable syscallfilter unconditionally (bsc#1181826).

Chrony was updated to 4.0:

Enhancements

• Add support for Network Time Security (NTS) authentication

• Add support for AES-CMAC keys (AES128, AES256) with Nettle

• Add authselectmode directive to control selection of unauthenticated sources

• Add binddevice, bindacqdevice, bindcmddevice directives

• Add confdir directive to better support fragmented configuration

• Add sourcedir directive and 'reload sources' command to support dynamic NTP sources specified in files

• Add clockprecision directive

• Add dscp directive to set Differentiated Services Code Point (DSCP)

• Add -L option to limit log messages by severity

• Add -p option to print whole configuration with included files

• Add -U option to allow start under non-root user

• Allow maxsamples to be set to 1 for faster update with -q/-Q option

• Avoid replacing NTP sources with sources that have unreachable address

• Improve pools to repeat name resolution to get 'maxsources' sources

• Improve source selection with trusted sources

• Improve NTP loop test to prevent synchronisation to itself

• Repeat iburst when NTP source is switched from offline state to online

• Update clock synchronisation status and leap status more frequently

• Update seccomp filter

• Add 'add pool' command

• Add 'reset sources' command to drop all measurements

• Add authdata command to print details about NTP authentication

• Add selectdata command to print details about source selection

• Add -N option and sourcename command to print original names of sources

• Add -a option to some commands to print also unresolved sources

• Add -k, -p, -r options to clients command to select, limit, reset data

• Bug fixes

• Don’t set interface for NTP responses to allow asymmetric routing

• Handle RTCs that don’t support interrupts

• Respond to command requests with correct address on multihomed hosts

• Removed features

• Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)

• Drop support for long (non-standard) MACs in NTPv4 packets (chrony 2.x clients using non-MD5/SHA1 keys need to use option 'version 3')

• By default we don't write log files but log to journald, so only recommend logrotate.

• Adjust and rename the sysconfig file, so that it matches the expectations of chronyd.service (bsc#1173277).

Chrony was updated to 3.5.1:

• Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)

• Add chrony-pool-suse and chrony-pool-openSUSE subpackages that preconfigure chrony to use NTP servers from the respective pools for SUSE and openSUSE (bsc#1156884, SLE-11424).

• Add chrony-pool-empty to still allow installing chrony without preconfigured servers.

• Use iburst in the default pool statements to speed up initial synchronisation (bsc#1172113).

• Update clknetsim to version 79ffe44 (fixes bsc#1162964).

Update to 3.5:

• Add support for more accurate reading of PHC on Linux 5.0
• Add support…

This update for chrony fixes the following issues:

Chrony was updated to 4.1, bringing features and bugfixes.

Update to 4.1

• Add support for NTS servers specified by IP address (matching Subject Alternative Name in server certificate)
• Add source-specific configuration of trusted certificates
• Allow multiple files and directories with trusted certificates
• Allow multiple pairs of server keys and certificates
• Add copy option to server/pool directive
• Increase PPS lock limit to 40% of pulse interval
• Perform source selection immediately after loading dump files
• Reload dump files for addresses negotiated by NTS-KE server
• Update seccomp filter and add less restrictive level
• Restart ongoing name resolution on online command
• Fix dump files to not include uncorrected offset
• Fix initstepslew to accept time from own NTP clients
• Reset NTP address and port when no longer negotiated by NTS-KE server

• Ensure the correct pool packages are installed for openSUSE and SLE (bsc#1180689).

• Fix pool package dependencies, so that SLE prefers chrony-pool-suse over chrony-pool-empty. (bsc#1194229)

• Enable syscallfilter unconditionally [bsc#1181826].

Update to 4.0

• Enhancements

  • Add support for Network Time Security (NTS) authentication
  • Add support for AES-CMAC keys (AES128, AES256) with Nettle
  • Add authselectmode directive to control selection of unauthenticated sources
  • Add binddevice, bindacqdevice, bindcmddevice directives
  • Add confdir directive to better support fragmented configuration
  • Add sourcedir directive and 'reload sources' command to support dynamic NTP sources specified in files
  • Add clockprecision directive
  • Add dscp directive to set Differentiated Services Code Point (DSCP)
  • Add -L option to limit log messages by severity
  • Add -p option to print whole configuration with included files
  • Add -U option to allow start under non-root user
  • Allow maxsamples to be set to 1 for faster update with -q/-Q option
  • Avoid replacing NTP sources with sources that have unreachable address
  • Improve pools to repeat name resolution to get 'maxsources' sources
  • Improve source selection with trusted sources
  • Improve NTP loop test to prevent synchronisation to itself
  • Repeat iburst when NTP source is switched from offline state to online
  • Update clock synchronisation status and leap status more frequently
  • Update seccomp filter
  • Add 'add pool' command
  • Add 'reset sources' command to drop all measurements
  • Add authdata command to print details about NTP authentication
  • Add selectdata command to print details about source selection
  • Add -N option and sourcename command to print original names of sources
  • Add -a option to some commands to print also unresolved sources
  • Add -k, -p, -r options to clients command to select, limit, reset data

• Bug fixes

  • Don’t set interface for NTP responses to allow asymmetric routing
  • Handle RTCs that don’t support interrupts
  • Respond to command requests with correct address on multihomed hosts

• Removed features

  • Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  • Drop support for long (non-standard) MACs in NTPv4 packets (chrony 2.x clients using non-MD5/SHA1 keys need to use option 'version 3')
  • Drop support for line editing with GNU Readline

• By default we don't write log files but log to journald, so only recommend logrotate.

• Adjust and rename the sysconfig file, so that it matches the expectations of chronyd.service (bsc#1173277).

Update to 3.5.1:

• Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)

• Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)

• Use iburst in the default pool statements to speed up initial …

This update for chrony fixes the following issues:

Chrony was updated to 4.1, bringing features and bugfixes.

Update to 4.1

• Add support for NTS servers specified by IP address (matching Subject Alternative Name in server certificate)
• Add source-specific configuration of trusted certificates
• Allow multiple files and directories with trusted certificates
• Allow multiple pairs of server keys and certificates
• Add copy option to server/pool directive
• Increase PPS lock limit to 40% of pulse interval
• Perform source selection immediately after loading dump files
• Reload dump files for addresses negotiated by NTS-KE server
• Update seccomp filter and add less restrictive level
• Restart ongoing name resolution on online command
• Fix dump files to not include uncorrected offset
• Fix initstepslew to accept time from own NTP clients
• Reset NTP address and port when no longer negotiated by NTS-KE server

• Ensure the correct pool packages are installed for openSUSE and SLE (bsc#1180689).

• Fix pool package dependencies, so that SLE prefers chrony-pool-suse over chrony-pool-empty. (bsc#1194229)

• Enable syscallfilter unconditionally [bsc#1181826].

Update to 4.0

• Enhancements

  • Add support for Network Time Security (NTS) authentication
  • Add support for AES-CMAC keys (AES128, AES256) with Nettle
  • Add authselectmode directive to control selection of unauthenticated sources
  • Add binddevice, bindacqdevice, bindcmddevice directives
  • Add confdir directive to better support fragmented configuration
  • Add sourcedir directive and 'reload sources' command to support dynamic NTP sources specified in files
  • Add clockprecision directive
  • Add dscp directive to set Differentiated Services Code Point (DSCP)
  • Add -L option to limit log messages by severity
  • Add -p option to print whole configuration with included files
  • Add -U option to allow start under non-root user
  • Allow maxsamples to be set to 1 for faster update with -q/-Q option
  • Avoid replacing NTP sources with sources that have unreachable address
  • Improve pools to repeat name resolution to get 'maxsources' sources
  • Improve source selection with trusted sources
  • Improve NTP loop test to prevent synchronisation to itself
  • Repeat iburst when NTP source is switched from offline state to online
  • Update clock synchronisation status and leap status more frequently
  • Update seccomp filter
  • Add 'add pool' command
  • Add 'reset sources' command to drop all measurements
  • Add authdata command to print details about NTP authentication
  • Add selectdata command to print details about source selection
  • Add -N option and sourcename command to print original names of sources
  • Add -a option to some commands to print also unresolved sources
  • Add -k, -p, -r options to clients command to select, limit, reset data

• Bug fixes

  • Don’t set interface for NTP responses to allow asymmetric routing
  • Handle RTCs that don’t support interrupts
  • Respond to command requests with correct address on multihomed hosts

• Removed features

  • Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)
  • Drop support for long (non-standard) MACs in NTPv4 packets (chrony 2.x clients using non-MD5/SHA1 keys need to use option 'version 3')
  • Drop support for line editing with GNU Readline

• By default we don't write log files but log to journald, so only recommend logrotate.

• Adjust and rename the sysconfig file, so that it matches the expectations of chronyd.service (bsc#1173277).

Update to 3.5.1:

• Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)

• Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)

• Use iburst in the default pool statements to speed up initial …

It was discovered that Chrony incorrectly handled certain symbolic links. An attacker could possibly use this issue to cause a denial of service or expose sensitive information.