{"id":"SUSE-SU-2021:4147-1","summary":"Security update for chrony","details":"This update for chrony fixes the following issues:\n\nChrony was updated to 4.1:\n\n* Add support for NTS servers specified by IP address (matching\n  Subject Alternative Name in server certificate)\n* Add source-specific configuration of trusted certificates\n* Allow multiple files and directories with trusted certificates\n* Allow multiple pairs of server keys and certificates\n* Add copy option to server/pool directive\n* Increase PPS lock limit to 40% of pulse interval\n* Perform source selection immediately after loading dump files\n* Reload dump files for addresses negotiated by NTS-KE server\n* Update seccomp filter and add less restrictive level\n* Restart ongoing name resolution on online command\n* Fix dump files to not include uncorrected offset\n* Fix initstepslew to accept time from own NTP clients\n* Reset NTP address and port when no longer negotiated by NTS-KE\n  server\n- Update clknetsim to snapshot f89702d.\n\n- Ensure the correct pool packages are installed for openSUSE and SLE (bsc#1180689).\n\n- Enable syscallfilter unconditionally (bsc#1181826).\n\nChrony was updated to 4.0:\n\nEnhancements\n\n- Add support for Network Time Security (NTS) authentication\n- Add support for AES-CMAC keys (AES128, AES256) with Nettle\n- Add authselectmode directive to control selection of\n  unauthenticated sources\n- Add binddevice, bindacqdevice, bindcmddevice directives\n- Add confdir directive to better support fragmented\n  configuration\n- Add sourcedir directive and 'reload sources' command to\n  support dynamic NTP sources specified in files\n- Add clockprecision directive\n- Add dscp directive to set Differentiated Services Code Point\n  (DSCP)\n- Add -L option to limit log messages by severity\n- Add -p option to print whole configuration with included\n  files\n- Add -U option to allow start under non-root user\n- Allow maxsamples to be set to 1 for faster update with -q/-Q\n  option\n- Avoid replacing NTP sources with sources that have\n  unreachable address\n- Improve pools to repeat name resolution to get 'maxsources'\n  sources\n- Improve source selection with trusted sources\n- Improve NTP loop test to prevent synchronisation to itself\n- Repeat iburst when NTP source is switched from offline state\n  to online\n- Update clock synchronisation status and leap status more\n  frequently\n- Update seccomp filter\n- Add 'add pool' command\n- Add 'reset sources' command to drop all measurements\n- Add authdata command to print details about NTP\n  authentication\n- Add selectdata command to print details about source\n  selection\n- Add -N option and sourcename command to print original names\n  of sources\n- Add -a option to some commands to print also unresolved\n  sources\n- Add -k, -p, -r options to clients command to select, limit,\n  reset data\n- Bug fixes\n- Don’t set interface for NTP responses to allow asymmetric\n  routing\n- Handle RTCs that don’t support interrupts\n- Respond to command requests with correct address on\n  multihomed hosts\n- Removed features\n- Drop support for RIPEMD keys (RMD128, RMD160, RMD256, RMD320)\n- Drop support for long (non-standard) MACs in NTPv4 packets\n  (chrony 2.x clients using non-MD5/SHA1 keys need to use\n  option 'version 3')\n\n- By default we don't write log files but log to journald, so\n  only recommend logrotate.\n\n- Adjust and rename the sysconfig file, so that it matches the\n  expectations of chronyd.service (bsc#1173277).\n\nChrony was updated to 3.5.1:\n\n* Create new file when writing pidfile (CVE-2020-14367, bsc#1174911)\n\n- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that\n  preconfigure chrony to use NTP servers from the  respective\n  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).\n- Add chrony-pool-empty to still allow installing chrony without\n  preconfigured servers.\n- Use iburst in the default pool statements to speed up initial\n  synchronisation (bsc#1172113).\n\n- Update clknetsim to version 79ffe44 (fixes bsc#1162964).\n\nUpdate to 3.5:\n\n+ Add support for more accurate reading of PHC on Linux 5.0\n+ Add support for hardware timestamping on interfaces with read-only timestamping configuration\n+ Add support for memory locking and real-time priority on FreeBSD, NetBSD, Solaris\n+ Update seccomp filter to work on more architectures\n+ Validate refclock driver options\n+ Fix bindaddress directive on FreeBSD\n+ Fix transposition of hardware RX timestamp on Linux 4.13 and later\n+ Fix building on non-glibc systems\n\n- Fix location of helper script in chrony-dnssrv@.service (bsc#1128846).\n\n- Read runtime servers from /var/run/netconfig/chrony.servers (bsc#1099272)\n- Move chrony-helper to /usr/lib/chrony/helper, because there should be no executables in /usr/share.\n- Remove discrepancies between spec file and chrony-tmpfiles (bsc#1115529) \n\nUpdate to version 3.4\n\n* Enhancements\n\n  + Add filter option to server/pool/peer directive\n  + Add minsamples and maxsamples options to hwtimestamp directive\n  + Add support for faster frequency adjustments in Linux 4.19\n  + Change default pidfile to /var/run/chrony/chronyd.pid to allow chronyd \n    without root privileges to remove it on exit\n  + Disable sub-second polling intervals for distant NTP sources\n  + Extend range of supported sub-second polling intervals\n  + Get/set IPv4 destination/source address of NTP packets on FreeBSD\n  + Make burst options and command useful with short polling intervals\n  + Modify auto_offline option to activate when sending request failed\n  + Respond from interface that received NTP request if possible\n  + Add onoffline command to switch between online and offline state \n    according to current system network configuration\n  + Improve example NetworkManager dispatcher script\n\n* Bug fixes\n\n  + Avoid waiting in Linux getrandom system call\n  + Fix PPS support on FreeBSD and NetBSD\n\nUpdate to version 3.3\n\n* Enhancements:\n\n  + Add burst option to server/pool directive\n  + Add stratum and tai options to refclock directive\n  + Add support for Nettle crypto library\n  + Add workaround for missing kernel receive timestamps on Linux\n  + Wait for late hardware transmit timestamps\n  + Improve source selection with unreachable sources\n  + Improve protection against replay attacks on symmetric mode\n  + Allow PHC refclock to use socket in /var/run/chrony\n  + Add shutdown command to stop chronyd\n  + Simplify format of response to manual list command\n  + Improve handling of unknown responses in chronyc\n\n* Bug fixes:\n\n  + Respond to NTPv1 client requests with zero mode\n  + Fix -x option to not require CAP_SYS_TIME under non-root user\n  + Fix acquisitionport directive to work with privilege separation\n  + Fix handling of socket errors on Linux to avoid high CPU usage\n  + Fix chronyc to not get stuck in infinite loop after clock step\n\n- Added /etc/chrony.d/ directory to the package (bsc#1083597) Modifed default chrony.conf to add 'include /etc/chrony.d/*'\n\n- Enable pps support\n\nUpgraded to version 3.2:\n\nEnhancements\n\n* Improve stability with NTP sources and reference clocks\n* Improve stability with hardware timestamping\n* Improve support for NTP interleaved modes\n* Control frequency of system clock on macOS 10.13 and later\n* Set TAI-UTC offset of system clock with leapsectz directive\n* Minimise data in client requests to improve privacy\n* Allow transmit-only hardware timestamping\n* Add support for new timestamping options introduced in Linux 4.13\n* Add root delay, root dispersion and maximum error to tracking log\n* Add mindelay and asymmetry options to server/peer/pool directive\n* Add extpps option to PHC refclock to timestamp external PPS signal\n* Add pps option to refclock directive to treat any refclock as PPS\n* Add width option to refclock directive to filter wrong pulse edges\n* Add rxfilter option to hwtimestamp directive\n* Add -x option to disable control of system clock\n* Add -l option to log to specified file instead of syslog\n* Allow multiple command-line options to be specified together\n* Allow starting without root privileges with -Q option\n* Update seccomp filter for new glibc versions\n* Dump history on exit by default with dumpdir directive\n* Use hardening compiler options by default\n\nBug fixes\n\n* Don't drop PHC samples with low-resolution system clock\n* Ignore outliers in PHC tracking, RTC tracking, manual input\n* Increase polling interval when peer is not responding\n* Exit with error message when include directive fails\n* Don't allow slash after hostname in allow/deny directive/command\n* Try to connect to all addresses in chronyc before giving up\n\nUpgraded to version 3.1:\n\n- Enhancements\n\n  - Add support for precise cross timestamping of PHC on Linux\n  - Add minpoll, precision, nocrossts options to hwtimestamp directive\n  - Add rawmeasurements option to log directive and modify measurements\n    option to log only valid measurements from synchronised sources\n  - Allow sub-second polling interval with NTP sources\n\n- Bug fixes\n\n  - Fix time smoothing in interleaved mode\n\nUpgraded to version 3.0:\n\n- Enhancements\n\n  - Add support for software and hardware timestamping on Linux\n  - Add support for client/server and symmetric interleaved modes\n  - Add support for MS-SNTP authentication in Samba\n  - Add support for truncated MACs in NTPv4 packets\n  - Estimate and correct for asymmetric network jitter\n  - Increase default minsamples and polltarget to improve stability with very low jitter\n  - Add maxjitter directive to limit source selection by jitter\n  - Add offset option to server/pool/peer directive\n  - Add maxlockage option to refclock directive\n  - Add -t option to chronyd to exit after specified time\n  - Add partial protection against replay attacks on symmetric mode\n  - Don't reset polling interval when switching sources to online state\n  - Allow rate limiting with very short intervals\n  - Improve maximum server throughput on Linux and NetBSD\n  - Remove dump files after start\n  - Add tab-completion to chronyc with libedit/readline\n  - Add ntpdata command to print details about NTP measurements\n  - Allow all source options to be set in add server/peer command\n  - Indicate truncated addresses/hostnames in chronyc output\n  - Print reference IDs as hexadecimal numbers to avoid confusion with IPv4 addresses\n\n- Bug fixes\n\n  - Fix crash with disabled asynchronous name resolving\n\nUpgraded to version 2.4.1:\n\n- Bug fixes\n\n  - Fix processing of kernel timestamps on non-Linux systems\n  - Fix crash with smoothtime directive\n  - Fix validation of refclock sample times\n  - Fix parsing of refclock directive\n\nupdate to 2.4:\n\n- Enhancements\n\n  - Add orphan option to local directive for orphan mode\n    compatible with ntpd\n  - Add distance option to local directive to set activation\n    threshold (1 second by default)\n  - Add maxdrift directive to set maximum allowed drift of system\n    clock\n  - Try to replace NTP sources exceeding maximum distance\n  - Randomise source replacement to avoid getting stuck with bad\n    sources\n  - Randomise selection of sources from pools on start\n  - Ignore reference timestamp as ntpd doesn't always set it\n    correctly\n  - Modify tracking report to use same values as seen by NTP\n    clients\n  - Add -c option to chronyc to write reports in CSV format\n  - Provide detailed manual pages\n\n- Bug fixes\n\n  - Fix SOCK refclock to work correctly when not specified as\n    last refclock\n  - Fix initstepslew and -q/-Q options to accept time from own\n    NTP clients\n  - Fix authentication with keys using 512-bit hash functions\n  - Fix crash on exit when multiple signals are received\n  - Fix conversion of very small floating-point numbers in\n    command packets\n","modified":"2026-02-04T03:33:15.695693Z","published":"2021-12-22T08:24:51Z","related":["CVE-2020-14367"],"upstream":["CVE-2020-14367"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2021/suse-su-20214147-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1063704"},{"type":"REPORT","url":"https://bugzilla.suse.com/1069468"},{"type":"REPORT","url":"https://bugzilla.suse.com/1082318"},{"type":"REPORT","url":"https://bugzilla.suse.com/1083597"},{"type":"REPORT","url":"https://bugzilla.suse.com/1099272"},{"type":"REPORT","url":"https://bugzilla.suse.com/1115529"},{"type":"REPORT","url":"https://bugzilla.suse.com/1128846"},{"type":"REPORT","url":"https://bugzilla.suse.com/1156884"},{"type":"REPORT","url":"https://bugzilla.suse.com/1159840"},{"type":"REPORT","url":"https://bugzilla.suse.com/1161119"},{"type":"REPORT","url":"https://bugzilla.suse.com/1162964"},{"type":"REPORT","url":"https://bugzilla.suse.com/1171806"},{"type":"REPORT","url":"https://bugzilla.suse.com/1172113"},{"type":"REPORT","url":"https://bugzilla.suse.com/1173277"},{"type":"REPORT","url":"https://bugzilla.suse.com/1173760"},{"type":"REPORT","url":"https://bugzilla.suse.com/1174075"},{"type":"REPORT","url":"https://bugzilla.suse.com/1174911"},{"type":"REPORT","url":"https://bugzilla.suse.com/1180689"},{"type":"REPORT","url":"https://bugzilla.suse.com/1181826"},{"type":"REPORT","url":"https://bugzilla.suse.com/1183783"},{"type":"REPORT","url":"https://bugzilla.suse.com/1184400"},{"type":"REPORT","url":"https://bugzilla.suse.com/1187906"},{"type":"REPORT","url":"https://bugzilla.suse.com/1190926"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-14367"}],"affected":[{"package":{"name":"chrony","ecosystem":"SUSE:HPE Helion OpenStack 8","purl":"pkg:rpm/suse/chrony&distro=HPE%20Helion%20OpenStack%208"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-5.9.1"}]}],"ecosystem_specific":{"binaries":[{"chrony":"4.1-5.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:4147-1.json"}},{"package":{"name":"chrony","ecosystem":"SUSE:OpenStack Cloud 8","purl":"pkg:rpm/suse/chrony&distro=SUSE%20OpenStack%20Cloud%208"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-5.9.1"}]}],"ecosystem_specific":{"binaries":[{"chrony":"4.1-5.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:4147-1.json"}},{"package":{"name":"chrony","ecosystem":"SUSE:OpenStack Cloud 9","purl":"pkg:rpm/suse/chrony&distro=SUSE%20OpenStack%20Cloud%209"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-5.9.1"}]}],"ecosystem_specific":{"binaries":[{"chrony":"4.1-5.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:4147-1.json"}},{"package":{"name":"chrony","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","purl":"pkg:rpm/suse/chrony&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-5.9.1"}]}],"ecosystem_specific":{"binaries":[{"chrony":"4.1-5.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:4147-1.json"}},{"package":{"name":"chrony","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","purl":"pkg:rpm/suse/chrony&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-5.9.1"}]}],"ecosystem_specific":{"binaries":[{"chrony":"4.1-5.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:4147-1.json"}},{"package":{"name":"chrony","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","purl":"pkg:rpm/suse/chrony&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-5.9.1"}]}],"ecosystem_specific":{"binaries":[{"chrony":"4.1-5.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:4147-1.json"}},{"package":{"name":"chrony","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","purl":"pkg:rpm/suse/chrony&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-5.9.1"}]}],"ecosystem_specific":{"binaries":[{"chrony":"4.1-5.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:4147-1.json"}},{"package":{"name":"chrony","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","purl":"pkg:rpm/suse/chrony&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-5.9.1"}]}],"ecosystem_specific":{"binaries":[{"chrony":"4.1-5.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:4147-1.json"}},{"package":{"name":"chrony","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","purl":"pkg:rpm/suse/chrony&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-5.9.1"}]}],"ecosystem_specific":{"binaries":[{"chrony":"4.1-5.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:4147-1.json"}},{"package":{"name":"chrony","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","purl":"pkg:rpm/suse/chrony&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCL"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-5.9.1"}]}],"ecosystem_specific":{"binaries":[{"chrony":"4.1-5.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:4147-1.json"}},{"package":{"name":"chrony","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","purl":"pkg:rpm/suse/chrony&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-5.9.1"}]}],"ecosystem_specific":{"binaries":[{"chrony":"4.1-5.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:4147-1.json"}},{"package":{"name":"chrony","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","purl":"pkg:rpm/suse/chrony&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-5.9.1"}]}],"ecosystem_specific":{"binaries":[{"chrony":"4.1-5.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:4147-1.json"}},{"package":{"name":"chrony","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","purl":"pkg:rpm/suse/chrony&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-5.9.1"}]}],"ecosystem_specific":{"binaries":[{"chrony":"4.1-5.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:4147-1.json"}}],"schema_version":"1.7.3"}