> The following nftables table drops incoming IPv4 TCP packets that contain IP options, which reduces exposure to this vulnerability but cannot fully prevent it.
I know things like eBPF can technically bypass netfilter if someone tries hard enough, but I'm not sure if they're referring to any other ways to exploit this that a netfilter rule can't catch.
A system running multiple network namespaces might also not have the same mitigations applied inside all of them.
But yes I agree it seems strange that most posts/articles/etc. are not prominently giving out mitigation strategies.
Red Hat also claims that netfilter is not enough: https://access.redhat.com/security/vulnerabilities/RHSB-2026...
> The following nftables table drops incoming IPv4 TCP packets that contain IP options, which reduces exposure to this vulnerability but cannot fully prevent it.
I know things like eBPF can technically bypass netfilter if someone tries hard enough, but I'm not sure if they're referring to any other ways to exploit this that a netfilter rule can't catch.
A system running multiple network namespaces might also not have the same mitigations applied inside all of them.
But yes I agree it seems strange that most posts/articles/etc. are not prominently giving out mitigation strategies.