CVE-2024-42861: Linuxptp Denial of Service Vulnerability

CVE-2024-42861 Overview

CVE-2024-42861 affects linuxptp versions 4.2 and earlier, an open-source implementation of the Precision Time Protocol (PTP) for Linux. The vulnerability resides in the IEEE 802.1AS time synchronization function, which processes peer delay messages between network nodes. A remote attacker can send a crafted Pdelay_Req message to trigger a denial of service condition in the affected daemon. Exploitation requires no authentication and no user interaction, and the attack can be launched over the network. The flaw disrupts time synchronization services that depend on linuxptp, which are commonly deployed in telecommunications, industrial control, financial trading, and audio/video bridging environments.

Critical Impact
Remote, unauthenticated attackers can crash the linuxptp time synchronization daemon by sending a single malformed Pdelay_Req packet, disrupting any service that depends on PTP timing accuracy.

Affected Products

linuxptp version 4.2
linuxptp versions prior to 4.2
Systems implementing IEEE 802.1AS via linuxptp

Discovery Timeline

2024-09-23 - CVE-2024-42861 published to NVD
2025-03-18 - Last updated in NVD database

Technical Details for CVE-2024-42861

Vulnerability Analysis

The vulnerability resides in the IEEE 802.1AS generalized PTP (gPTP) implementation within linuxptp. IEEE 802.1AS defines a profile of PTP used for time-sensitive networking. Peer-to-peer delay measurement relies on Pdelay_Req, Pdelay_Resp, and Pdelay_Resp_Follow_Up message exchanges to calculate link propagation delay.

A crafted Pdelay_Req message processed by the linuxptp daemon causes the time synchronization function to fail, terminating or hanging the process. Because PTP daemons typically listen on multicast addresses on the local network segment, any host with Layer 2 reachability to the target can trigger the condition without authentication. The CWE classification is listed as NVD-CWE-noinfo, indicating the upstream root cause category was not enumerated in the public advisory.

Loss of the PTP daemon eliminates sub-microsecond clock alignment between nodes. Downstream effects include broken audio/video synchronization, failed industrial control sequencing, and degraded distributed system consistency.

Root Cause

The root cause is improper validation of fields within an incoming Pdelay_Req message in the IEEE 802.1AS handling path of linuxptp 4.2 and earlier. The handler does not adequately sanitize attacker-controlled values before they reach state-tracking logic in the synchronization function. Public details beyond the advisory description are limited; see the GitHub PoC Repository for proof-of-concept material.

Attack Vector

The attack vector is network-based with low complexity. An attacker on the same Layer 2 segment, or with a path to the PTP multicast group, sends a single malformed Pdelay_Req frame to the target. No credentials or user interaction are required. The result is loss of the time synchronization service, satisfying the availability impact reflected in the CVSS vector.

Detection Methods for CVE-2024-42861

Indicators of Compromise

Unexpected termination, crash, or repeated restart of the ptp4l daemon process on Linux hosts running linuxptp 4.2 or earlier.
Sudden loss of PTP clock synchronization or large time offsets reported by downstream consumers of the PTP clock.
Inbound Pdelay_Req (PTP message type 0x2) packets to multicast 01:80:C2:00:00:0E from unexpected source MAC addresses.

Detection Strategies

Monitor process supervision logs (systemd, journalctl -u ptp4l) for abnormal exits, signal terminations, or watchdog restarts of the PTP daemon.
Deploy network IDS signatures that flag malformed IEEE 802.1AS Pdelay_Req frames or Pdelay_Req traffic originating from non-authorized PTP peers.
Correlate linuxptp daemon crash events with packet captures from span ports on time-sensitive network segments.

Monitoring Recommendations

Track PTP clock offset and synchronization state through pmc or telemetry exporters and alert on sustained loss of lock.
Baseline expected PTP peer MAC addresses on each segment and alert on new sources of Pdelay_Req traffic.
Forward host telemetry and packet metadata to a centralized analytics platform to identify coordinated DoS attempts across multiple PTP nodes.

How to Mitigate CVE-2024-42861

Immediate Actions Required

Inventory all hosts running linuxptp and identify those on version 4.2 or earlier.
Upgrade linuxptp to a release that contains the fix for the IEEE 802.1AS Pdelay_Req handling defect.
Restrict PTP traffic to dedicated VLANs or isolated network segments where only trusted clock peers reside.

Patch Information

No vendor advisory URL is published in the NVD record. Administrators should obtain updated linuxptp source from the upstream project and rebuild, or apply distribution security updates as they become available. Refer to the GitHub PoC Repository for context on the reproduction conditions when validating patches.

Workarounds

Apply Layer 2 access control lists or MAC address filtering to restrict which devices can send Pdelay_Req frames to the daemon.
Disable the IEEE 802.1AS profile in linuxptp configuration where it is not required and revert to a different PTP profile.
Place PTP-enabled hosts on dedicated, physically or logically isolated time-distribution networks to limit attacker reachability.

bash

# Example: restrict ptp4l to a trusted interface and disable 802.1AS profile
# /etc/linuxptp/ptp4l.conf
[global]
network_transport L2
delay_mechanism   E2E
# Avoid the affected gPTP/802.1AS profile until patched
# (remove or replace any 'gPTP.cfg' include directive)

[eth1]
# Bind only to the dedicated time-sync interface