CVE-2024-2169

A vulnerability was found in certain UPD protocol implementations. This issue may allow an unauthenticated attacker to send maliciously crafted packages leading to a denial of service on the targeted system. An attacker needs to perform the attack on a vulnerable server in order to meet the conditions to create the necessary traffic-loop for a successful attack.

Red Hat is aware of the existence of CVE-2024-2169 and has investigated the impact in several packages distributed across Red Hat Enterprise Linux versions. The versions of the NTP package shipped with Red Hat Enterprise Linux 6 and 7 are not vulnerable to this attack, as this issue was dependent on CVE-2009-3563 present in ntp up to 4.2.4p8 and 4.2.5, which are older than the versions shipped with the mentioned products.

Package implementations of DNS (such as dnsmasq and bind), tftp, and dhcp packages as distributed with Red Hat Enterprise Linux are not affected by this vulnerability as all of it uses a random source port for response, making it impossible to perform a traffic-loop attack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.