Re: [PATCH 1/1] net/ipv4: discard icmp timestamp requests

On 23 Jul 2026, at 10:08, Ido Schimmel [off-list ref] wrote:

On Wed, Jul 22, 2026 at 11:24:41AM +0100, jch@thehaxbys.co.uk wrote:

quoted

An icmp timestamp request is classed a a minor security vulnerability
(CVE-1999-0524) due to an information leak.  As pretty much everything
uses NTP these days, it's not as though this is an actual problem but
scanners flag this so for everyone's sake, let's just discard timestamp
requests.

The idea was discussed in the past and was rejected:

https://lore.kernel.org/netdev/1557711193-7284-1-git-send-email-chenweilong@huawei.com/ (local)
https://lore.kernel.org/netdev/1557754137-100816-1-git-send-email-chenweilong@huawei.com/ (local)
https://lore.kernel.org/netdev/20240520165335899feIJEvG6iuT4f7FBU6ctk@zte.com.cn/ (local)

I don't see a reason to revisit this.

In fact, there is a reason to revisit this.  CVE-1999-0524 went from having a CVSS score of 0.0 (ie not a vulnerability) to CVSS2 score 2.1 in 2022 and today it has a CVSS3.x score of 4.0.   Those first two links are messages in 2019, well before there was a non-zero score.  The last link is, admittedly, 2024 but rather than completely removing ICMP timestamp (as was done with ICMP address, the other part of CVE-1999-0524) is provides a sysctl to turn it off.   I wasn't aware of that possible patch, but it assumes that there's a use-case for ICMP timestamp and in the few years I've been aware of this as an issue (in my previous job) I haven't found one.

Admittedly, it's easy to just disable the timestamp in a firewall (eg firewall-cmd --add-icmp-block=timestamp-request) but people have to discover that after a scanner has screamed warnings about unfixed vulnerabilities.  So now I have actual time on my hands not dealing with the daily firefight of kernel CVEs, I had time to actually do something about this that's been annoying me and quite a lot of other people -- I mentioned googling for "CVE-1999-0524 fix".

If there's a genuine use-case for ICMP timestamp, then yes, it should stay and we'll just add to the documentation from Cisco, f5, Dell, Oracle, etc to explain how to disable it if you don't have that use case.  But lacking a use-case, I still think ICMP timestamp should simply be consigned to the bin.

jch