Unrated severityNVD Advisory· Published Apr 16, 2015· Updated May 6, 2026

CVE-2015-1822

Description

chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.

Affected products

Tuxfamily/Chrony
cpe:2.3:a:tuxfamily:chrony:*:*:*:*:*:*:*:*
Range: <=1.31
Debian/Debian Linux
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

listengine.tuxfamily.org/chrony.tuxfamily.org/chrony-announce/2015/04/msg00002.htmlnvdPatchVendor Advisory
www.debian.org/security/2015/dsa-3222nvd
www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlnvd
www.securityfocus.com/bid/73956nvd
security.gentoo.org/glsa/201507-01nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000