{"id":"CVE-2015-1822","aliases":["DEBIAN-CVE-2015-1822","DLA-193-1","DSA-3222-1","EUVD-2015-1942","GHSA-rchf-p2rm-hg6h","MGASA-2015-0163","RHSA-2015:2241","UBUNTU-CVE-2015-1822"],"status":"published","title":"chrony before 1.31.1 does not initialize the last \"next\" pointer when saving unacknowledged...","description":"chrony before 1.31.1 does not initialize the last \"next\" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.","severity":{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02936,"percentile":0.87197,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-17"],"published":"2015-04-12T00:00:00Z","modified":"2026-09-09T06:47:30Z","fixes":[{"ecosystem":"Debian:12","package":"chrony","fixed_in":["1.30-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"chrony","fixed_in":["1.30-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"chrony","fixed_in":["1.30-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"chrony","fixed_in":["1.29-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30-2"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-3+squeeze2"}]}],"versions":["1.24-3","1.24-3+squeeze1"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24-3.1+deb7u3"}]}],"versions":["1.24-3.1+deb7u1","1.24-3.1+deb7u2"],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29.1-1.1.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"chrony-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"chrony-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"chrony-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"chrony-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.1-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"chrony","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-1ubuntu0.1"}]}],"versions":["1.26-4","1.29-1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"tuxfamily","product":"chrony"}],"references":[{"url":"http://www.debian.org/security/2015/dsa-3222","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-announce/2015/04/msg00002.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201507-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/73956","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1822","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:2241","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209632","tags":["report"]},{"url":"https://github.com/advisories/GHSA-rchf-p2rm-hg6h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1822","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0163.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15647","tags":["report"]},{"url":"http://chrony.tuxfamily.org/News.html","tags":["web","report"]},{"url":"https://www.debian.org/security/2015/dsa-3222","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1117882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1169353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1206504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209572","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1209631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1211600","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1219492","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2241.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1821","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1821","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1822","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1853","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-1822","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-1822","description":"chrony before 1.31.1 does not initialize the last \"next\" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.","status":"published","published":"2015-04-16T14:00:00Z","modified":"2024-08-06T04:54:16.319Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2015-1942","description":"chrony before 1.31.1 does not initialize the last \"next\" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.","status":"published","published":"2015-04-16T14:00:00Z","modified":"2024-08-06T04:54:16Z","updated_at":"2026-11-03T02:22:14.212001Z"}],"ghsa":[{"id":"GHSA-rchf-p2rm-hg6h","title":"chrony before 1.31.1 does not initialize the last \"next\" pointer when saving unacknowledged...","description":"chrony before 1.31.1 does not initialize the last \"next\" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.","status":"published","published":"2022-05-17T02:38:51Z","modified":"2023-02-02T21:34:02Z","updated_at":"2026-11-02T14:52:47.993176Z"}],"nvd":[{"id":"CVE-2015-1822","description":"chrony before 1.31.1 does not initialize the last \"next\" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.","status":"published","published":"2015-04-16T14:59:03.023Z","modified":"2026-06-17T00:23:04.233Z","cvss":[{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-17"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"CVE-2015-1822","description":"chrony before 1.31.1 does not initialize the last \"next\" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.","status":"published","published":"2015-04-16T14:59:03Z","modified":"2026-04-16T06:25:05.357106485Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-1822","description":"chrony before 1.31.1 does not initialize the last \"next\" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.","status":"published","published":"2015-04-16T14:59:03.023Z","modified":"2026-09-09T06:47:30.392155179Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-193-1","title":"chrony - security update","status":"published","published":"2015-04-12T00:00:00Z","modified":"2026-03-09T01:21:20.727005Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-3222-1","title":"chrony - security update","status":"published","published":"2015-04-12T00:00:00Z","modified":"2026-03-09T01:18:47.627488Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0163","title":"Updated chrony packages fix security vulnerabilities","description":"Updated chrony package fixes security vulnerabilities:\n\nUsing particular address/subnet pairs when configuring access control would\ncause an invalid memory write. This could allow attackers to cause a denial\nof service (crash) or execute arbitrary code (CVE-2015-1821).\n\nWhen allocating memory to save unacknowledged replies to authenticated\ncommand requests, a pointer would be left uninitialized, which could trigger\nan invalid memory write. This could allow attackers to cause a denial of\nservice (crash) or execute arbitrary code (CVE-2015-1822).\n\nWhen peering with other NTP hosts using authenticated symmetric association,\nthe internal state variables would be updated before the MAC of the NTP\nmessages was validated. This could allow a remote attacker to cause a denial\nof service by impeding synchronization between NTP peers (CVE-2015-1853).\n","status":"published","published":"2015-04-23T21:14:25Z","modified":"2026-04-16T06:24:47.505136031Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"RHSA-2015:2241","title":"Red Hat Security Advisory: chrony security, bug fix, and enhancement update","status":"published","published":"2024-09-15T22:35:28Z","modified":"2026-06-27T10:03:27Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"UBUNTU-CVE-2015-1822","description":"chrony before 1.31.1 does not initialize the last \"next\" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.","status":"published","published":"2015-04-16T14:59:00Z","modified":"2025-09-08T16:43:20Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}