Symlink Vulnerability in Chrony Package: CVE-2020-14367
Summary
ALPINE-CVE-2020-14367: A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. Affects chrony versions < 3.5.1-r0. Fixed in 3.5.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Chrony is a versatile Network Time Protocol (NTP) client and server designed to keep the system clock accurate. It is particularly useful in environments where the system may not have continuous network access. The package is known for its efficiency and ability to synchronize time quickly, making it a popular choice for many Linux distributions, including Alpine. However, a critical vulnerability has been identified in Chrony versions prior to 3.5.1, which could lead to severe security risks.
Vulnerability Detail
A flaw was found in Chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chronyd startup while still running as the root user. When opened for writing, chronyd does not check for an existing symbolic link with the same file name. This oversight allows an attacker with privileged access to create a symlink with the default PID file name pointing to any destination file in the system, leading to potential data loss and denial of service due to path traversal.
How To Fix
Minimum fixed version
3.5.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade chronyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the /var/run/chrony directory to prevent unauthorized users from creating symbolic links. This can be done by changing the permissions of the directory using the command: 'chmod 700 /var/run/chrony'. However, this does not fully mitigate the risk and should only be used until the package is updated.
Conclusion
The vulnerability CVE-2020-14367 in the Chrony package poses significant risks due to improper handling of PID files. It is crucial for users to update to the patched version to mitigate these risks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your systems.
See every vulnerability recorded for chrony →
FAQ
CVE-2020-14367 is a vulnerability in the Chrony package that allows an attacker to exploit symlink creation, potentially leading to data loss and denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to data loss and denial of service, as attackers can manipulate the PID file to point to arbitrary files.
Yes, the patch is available in Chrony version 3.5.1-r0 and later. Updating to this version will resolve the issue.
The CVSS score of CVE-2020-14367 is 6.0, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for chrony.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
