ntpd (NTP.org reference implementation): An off-path attacker can block a node's unauthenticated time synchronization

Impact

An off-path attacker can block a node's unauthenticated time synchronization by spoofing the source IP in a server-mode packet. Clock drift is an underrated cluster failure mode: it breaks TLS validity windows, Kerberos, distributed tracing correlation, checkpoint ordering, and any scheduler that reasons about deadlines. An attacker who can freeze your clocks without touching your data plane has a quiet, hard-to-attribute lever.

Who can reach it

Off-path attacker able to spoof source addresses toward the NTP client. Does not require being on the path between client and server.

What to do

Upgrade ntp to 4.2.8p14 or later (or migrate to chrony, which most modern distributions default to) and restart the service. Package upgrade, no reboot. The structural fix is authenticated time — NTS or symmetric-key NTP — plus internal stratum-1 sources rather than public pools; that is a config and topology change and it is what actually removes this class.

References