Hello, welcome to the Thursday, September 30th, 2021 edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

Today, we have an interesting bug to start out with in GPSD.

GPSD is a GPS demon used to decode GPS signals and often used to synchronize

time services. The bug will be triggered on October 16th, so in about two weeks, and it will cause

your time to go back by about 20 years, a thousand, 24 weeks.

Now, why 1,024 weeks?

That's a little bit an oddity in the GPS design.

The time that you actually receive, the time signal that you receive from a GPS satellite has two parts.

One part is the number

of the week and well historically that was expressed in 10 bits. So you have a thousand

24 different weeks available. That cause of course occasionally in rollover and the GPS software

is accounting for that. In this case, they just sort of

messed up at the time when they have to actually account for this rollover. And the result is that

in two weeks on October 16th, GPSD, if you have a buggy version, will go back by two weeks.

GPSD versions 3.20 up to 3.22 are vulnerable 3.23.1, which was released just about a week ago.

September 21st is the first version that is fixed.

So make sure that you update.

You have two weeks.

The updates should be available for common Unix distributions.

Of course, a lot of these NTP servers are running on little appliances and such,

and an upgrade may not be as obvious as

...