ntpd (transmit timestamp prediction): A remote attacker who can predict transmit timestamps can crash ntpd or, worse

Impact

A remote attacker who can predict transmit timestamps can crash ntpd or, worse, change the system time. Changing the time on a cluster node is a more interesting attack than crashing it: certificates become valid or invalid, log timestamps stop lining up with reality, and scheduled jobs fire at the wrong moment.

Who can reach it

Remote attacker able to predict the client's transmit timestamps for outgoing packets.

What to do

Upgrade ntp to 4.2.8p14 or later, or move to chrony/NTS. Package upgrade and service restart. Monitor for step changes in system time as a detection control — most fleets do not alert on this and should.

References

Related entries

• Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN): A device plugged into a normal front-panel port can talk itsCVE-2021-1228 · Cisco Nexus 9000 in ACI mode (fabric infrastructure VLAN)High
• HTCondor (daemon-to-daemon channel, negotiator/startd/schedd): Secret material crosses the network in the clear whenCVE-2021-45104 · HTCondor (daemon-to-daemon channel, negotiator/startd/schedd)High
• Harbor registry: P2P preheat execution logs readable/updatable by any authenticated user via job ID enumerationCVE-2022-31671 · Harbor registryHigh
• MinIO (admin server-update API): An authenticated request to the server-update admin API traverses out of the intendedCVE-2022-35919 · MinIO (admin server-update API)High
• Cisco Nexus 3000/9000 (health monitoring diagnostics): The health monitoring diagnostics subsystem on Nexus 3000 andCVE-2025-20111 · Cisco Nexus 3000/9000 (health monitoring diagnostics)High
• Confluent Kafka Python client: TLS certificate verification disabled by default toward HashiCorp Vault KMSCVE-2026-15911 · Confluent Kafka Python client (HashiCorp Vault KMS integration)High