Linux and FreeBSD: Multiple TCP-based remote denial of service vulnerabilities

I read the situation as being worse for Linux (3 CVEs, including one remotely-inducable kernel panic, spanning many versions) than for FreeBSD (1 CVE that can be exploited to slow down a target system in the latest major version).

But even granting that both affected OS flavors have serious DoS issues, a service that used a mix of OS flavors in its servers would be more resistant (not impervious) to attacks based on these TCP problems than a service using only one flavor. So do you really count this as a failure of N-version programming? (Honest question! This is not my area of expertise.)

> I wonder how they did this - fuzzing perhaps?

That, reviewing/auditing kernel code or they got hit with it.

There are entities out there sitting on hundreds of 0days. Governments buy hundreds every year.

Things aren't really getting much better either, so yeah, could totally crumble.`

Reminds me of a (now defunct) computer un-conference I went to about 8 or 9 years ago. I left fulfilled and defeated by how vulnerable everything seemed.

Whenever I went to a “professional” conference in my field from then-on, I just felt disappointed in how little I got to learn.