CVE-2010-0293 json
The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client infor…
published 2010-02-08 16 y ago modified 2026-06-16 4 mo ago also EUVD-2010-0324
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.7%
- EPSS 2.7% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
The client logging functionality in chronyd in Chrony before 1.23.1 does not restrict the amount of memory used for storage of client information, which allows remote attackers to cause a denial of service (memory consumption) via spoofed (1) NTP or (2) cmdmon packets.
Patch / fix
- chrony Debian 14, Debian 13, Debian 12 1.23-7
debian advisories DEBIAN-CVE-2010-0293
Exploit prediction
2.67% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Classification
- Weakness
-
- CWE-399 Resource Management Errors
References
-
debian.org
/security/2010/dsa-1992
vendor-advisory
-
chrony.tuxfamily.org
/News.html
vendor-advisory
-
secunia.com
/advisories/38428
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/38480
third-party-advisory, vendor-advisory
-
securityfocus.com
/bid/38106
vdb-entry
- git.tuxfamily.org /chrony/chrony.git/?p=gitroot/chrony/chrony.git%3Ba=commit%3Bh=2f63cf448560fdb96b80d8488aae6a15b802a753
- bugzilla.redhat.com /show_bug.cgi?id=555367
Sources
- CVE List CVE-2010-0293
- NVD CVE-2010-0293
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.