linuxptp / ptp4l (PTP message forwarding): A missing length check when ptp4l forwards a PTP message between ports leaks

Impact

A missing length check when ptp4l forwards a PTP message between ports leaks memory contents to a remote attacker and can be pushed into a crash. PTP is the time source for AI clusters that do distributed tracing, RDMA telemetry correlation, or lockstep checkpointing — and ptp4l typically runs as root with raw socket access on every node. An information leak out of that process is a leak out of a root-privileged daemon reachable from the fabric.

Who can reach it

Remote — any host that can send PTP messages to a node running ptp4l as a boundary/transparent clock. PTP is unauthenticated by default, so no credentials are involved and any tenant on the same segment qualifies.

What to do

Package upgrade of linuxptp and a restart of ptp4l — no reboot needed, and the restart costs a brief loss of clock discipline rather than a node outage. The durable control is to run PTP on a dedicated VLAN that tenant workloads cannot source traffic onto, which is a switch config change.

References