linuxptp / ptp4l (PTP message forwarding): A missing length check when ptp4l forwards a PTP message between ports leaks

Impact

A missing length check when ptp4l forwards a PTP message between ports leaks memory contents to a remote attacker and can be pushed into a crash. PTP is the time source for AI clusters that do distributed tracing, RDMA telemetry correlation, or lockstep checkpointing — and ptp4l typically runs as root with raw socket access on every node. An information leak out of that process is a leak out of a root-privileged daemon reachable from the fabric.

Who can reach it

Remote — any host that can send PTP messages to a node running ptp4l as a boundary/transparent clock. PTP is unauthenticated by default, so no credentials are involved and any tenant on the same segment qualifies.

What to do

Package upgrade of linuxptp and a restart of ptp4l — no reboot needed, and the restart costs a brief loss of clock discipline rather than a node outage. The durable control is to run PTP on a dedicated VLAN that tenant workloads cannot source traffic onto, which is a switch config change.

References

Related entries

• Terraform Enterprise: Missing authorization on a subset of run-token API requestsCVE-2021-36230 · Terraform EnterpriseHigh
• AMD System Management Mode (SMM) interrupt handler: A flaw in the AMD SMM interrupt handler lets a high-privilegeCVE-2021-39298 · AMD System Management Mode (SMM) interrupt handlerHigh
• MinIO (IAM policy engine): A regular user can step outside the policy restrictions applied to them, reaching operationsCVE-2021-41137 · MinIO (IAM policy engine)High
• MinIO: Hand-crafted admin API call updates a user's policyCVE-2021-43858 · MinIOHigh
• Samba (SMB gateway): Out-of-bounds heap read/write in vfs_fruitCVE-2021-44142 · Samba (SMB gateway)High
• HTCondor (SciTokens authentication): A SciToken is granted more authorization than the token's scopes should permit.CVE-2021-45102 · HTCondor (SciTokens authentication)High