majorchord

The bug in question is not mitigated by any userspace actions (like signing binaries or boot images) or even by limiting syscalls, and all it takes is a listening socket on the device from either direction (inside or outside the network) to get root since router-destined packets are always processed by the CPU.

> I trust the Ubuntu team to issue quick fixes

Except in this case they have not issued any fix, for several weeks, to an extremely critical issue that most other distros have already patched for some time now.

For many this now means their trust is broken.

Red Hat claims[1] that's not enough:

> The following nftables table drops incoming IPv4 TCP packets that contain IP options, which reduces exposure to this vulnerability but cannot fully prevent it.

I suppose locally-running malicious programs could send packets to the loopback address or one of its own IPs or something.

[1] https://access.redhat.com/security/vulnerabilities/RHSB-2026...

> We have no evidence that your application data was accessed.

Translation: We don't know how we were hacked and can't tell what anyone did or didn't look at.

In that case I would treat it as full compromise and urge everyone who might be potentially affected to change password, rotate keys, whatever you need to do to protect yourself.

Any TCP packet (with IP options) you can send to a Linux kernel that doesn't get DROP'd by netfilter makes you technically vulnerable.

That includes the one port your LAMP stack uses.

Or, the attacker might be originating from the other side of a device, like within a LAN. Malicious employees/house guests/what-have-you could target devices from inside your network where most servers don't have as much protection or have other open ports accessible.

According to wikipedia[1]:

> A zero-day (also known as a 0-day) is a vulnerability or security hole in a computer system unknown to its developers or anyone capable of mitigating it.

Apparently the meaning has evolved over the years.

[1] https://en.wikipedia.org/wiki/Zero-day_vulnerability

> I have not seen an exploit in the wild.

How would you see one? Have you deployed your own army of honeypots that are actively logging and looking for corrupt IP options packets? If you're not already looking for it, I think it's very likely that most people who get hacked will have no way of knowing how it happened, so we can't consider those incidents as being a result of this particular bug.

Are you actually monitoring for this specifically or just trying to use a sample size of 1 group of servers to prove something?

I know the context here is consumer routers, but for those reading who might be running a server, or a homelab, or anything that does accept connections from outside, I want to make it clear that "most likely not" turns into "likely trivial if targeted" for servers.

They also don't provide any mitigation possibilities or instructions... RHEL has one method here: https://access.redhat.com/security/vulnerabilities/RHSB-2026...

However they also claim the mitigation "reduces exposure to this vulnerability but cannot fully prevent it", without elaborating on what that means or how it would be possible... I've also not seen anyone else make this claim.

> If every state followed suit, the problem would be solved.

Or it creates an entirely new problem. People like this don't just go away after hitting a single roadblock.

Is there a PoC that exploits this without MPTCP?

Both. But these "arbitrary provisions" are extremely common in business contracts, and not inherently illegal unless it's asking you to break a law... but a judge can still enforce the terms if one side is not cooperating.

Thankfully the vast majority of servers are not creating MPTCP listeners by default (that I'm aware of).

Not sure why the article doesn't mention it, but you can specifically check for MPTCP listeners using `ss -M`.

> What rules?

The terms of the legal contract they both would have signed.

Companies generally don't get to do business with the US Government without following their strict rules.

> Once this done, where will the general knowledge to train AI come from?

I think this assumes that all professionals will eventually disappear and be replaced entirely with AI, and I don't agree with that.

The existence of AI does not dictate that developers can or will no longer exist (and not everyone will even use AI). I think we will still have enough data to train from... and if not, then the AI simply won't be used for that and people will learn again the old fashioned way.

Is there a reason you seem to believe this "jank" in the AI software world will stay the same forever? The policies, testing and general knowledge of the professionals are part of what's training the AI models... accurately passing all necessary software standards/certifications/policies are just a few (near future) prompts away.

Not only that, but you constantly feel like Idiocracy is playing out in real time, and that everyone else around you is closer to monkeys than a rational empathetic human... it's exhausting, lonely and debilitating. Then you realize there are people much smarter than you, and you wonder how they must feel.

Reminds me of that House MD episode where the delivery driver was a secret genius who was abusing DXM to dumb himself down just to feel happy.

"For with much wisdom comes much sorrow; the more knowledge, the more grief."

Indeed, I think skills are like muscles... you need to keep using them well to stay strong. If you farm out all your thinking to an AI, your own skills and knowledge will diminish and your ability to design/debug/reason about your own (or any) code can fade.

> whose authority to make that "official" only extends to a single branch of a single level of government.

Yes, and Google has huge contracts with the government, meaning they must adhere to their rules if they want to keep those contracts.

> If you do your petitioning and then get shot by a government agent, then the piece of paper giving you the right is worthless and you don't really have the right.

Hard disagree, there is no evidence that the agent acted in that exact way at the instruction of the government, I do not believe that it makes people's rights worth any less.

To me this is like saying rights are somehow fundamentally useless just because murderers exist in the world. Or accidents. Makes absolutely no sense to me whatsoever.

Preliminary search reveals dozens of matches.

There is no edit button for me :/

HN Note: It removed the word "Totally" in front of "Sick" in the title, which I think changes the implied meaning in a negative way.

Yet they have no problems with animals on flights with people who are deathly allergic, and have no way to guarantee you will not be put on such a flight, especially when last minute changes happen frequently.

Those who live in glass houses shouldn't throw stones. You're using technology too, and also breaking the site rules at the same time.

> In the United States, the right to petition is enumerated in the First Amendment to the United States Constitution, which specifically prohibits Congress from abridging "the right of the people peaceably to assemble, and to petition the Government for a redress of grievances".

I think the key point is that it allows this "petitioning" of the government in the first place, that's what it's good for. But you still have to go through the court system to right any wrongs, which includes misbehaving police who may be breaking the law themselves.

The Constitution is not a judge, jury or executioner, so in a way it was always "limited" in what it can do if it's not actually respected.

I don't understand the issue since no law can physically prevent people from breaking it.

Of course cops are the government, but they're also humans that make mistakes and commit crimes themselves. But this isn't actually related to some greater constitutional crisis or anything, unless you have some evidence that suggests they were instructed to act the way they did... but I've never seen anyone come forward with that yet.