CVE-2026-102484
Description
A flaw was found in NTPsec. This vulnerability allows an attacker who controls a Telephone JJY time source to crash the daemon, resulting in a Denial of Service (DoS), or cause memory corruption. The issue stems from a heap-based buffer overflow in the JJY reference clock driver when processing more than six time replies.
Statement
This vulnerability is rated as Moderate severity rather than Important because successful exploitation requires specialized physical access or control over a dedicated telephone modem line to supply malicious responses to the daemon. Red Hat Enterprise Linux utilizes chrony as its default time synchronization provider, and NTPsec is distributed only through community channels such as EPEL. Furthermore, standard deployments do not enable the JJY reference clock driver by default, limiting exposure strictly to systems explicitly configured to receive time signals from a Telephone JJY source.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
