CVE-2010-0293 in chrony
Summary
by MITRE
The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information, which allows remote attackers to cause a denial of service (memory consumption) via spoofed (1) NTP or (2) cmdmon packets.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/30/2026
The vulnerability identified as CVE-2010-0293 affects the chronyd time synchronization daemon in Chrony versions prior to 1.23.1, presenting a significant denial of service risk through memory exhaustion attacks. This issue resides within the client logging subsystem where the daemon fails to implement proper memory management controls for storing client information, creating a persistent resource consumption flaw that can be exploited by remote attackers.
The technical flaw manifests when chronyd processes spoofed network packets, specifically NTP or cmdmon packets, which trigger the client logging functionality. Unlike legitimate client connections that would be properly managed and eventually cleaned up, spoofed packets cause the daemon to continuously allocate memory for storing client information without adequate bounds checking or memory limits. This behavior creates a memory leak scenario where each malicious packet consumption increases the daemon's memory footprint indefinitely, leading to system instability and potential service interruption.
Attackers can exploit this vulnerability by sending crafted spoofed NTP or cmdmon packets to the target chronyd service, causing the daemon to allocate memory continuously until system resources are exhausted. The attack requires minimal privileges and can be executed from remote locations, making it particularly dangerous in networked environments where time synchronization services are exposed to untrusted networks. The vulnerability specifically targets the daemon's handling of client connection data, where legitimate connection tracking is bypassed in favor of unbounded memory allocation.
This vulnerability directly maps to CWE-772, which addresses "Missing Release of Resource after Effective Lifetime," and represents a classic example of resource exhaustion through inadequate memory management. The operational impact extends beyond simple denial of service to potentially compromise system stability and availability of time synchronization services critical for network operations, authentication systems, and distributed computing environments. The attack vector leverages the ATT&CK technique T1499.004, "Endpoint Denial of Service," specifically targeting the availability of time synchronization services.
Mitigation strategies include upgrading to Chrony version 1.23.1 or later, where proper memory limits and client tracking controls have been implemented. Administrators should also consider implementing network-level restrictions to limit access to chronyd services, particularly disabling cmdmon functionality when not required. Additional protective measures include monitoring memory consumption patterns of the chronyd process and implementing automated alerts for unusual resource usage that could indicate exploitation attempts. System hardening practices should include configuring proper access controls and network segmentation to limit exposure of time synchronization services to untrusted networks.