Hacker News Reader

Comment by bawolff | Hacker News Reader

> but this is a bug that could crash your system but is unlikely to expose your confidential system data to attackers

Given people have demonstrated getting root with it, unlikely seems questionable

> Especially given that the exploit can only be done if packets with IP options. IP options are commonly dropped or removed from packets on the open web.

It sounds like iphones use mptcp in the wild, which use tcp options, so im not sure how true this is.

View on HN

TCP options are quite different from IP options.

IP options are annoying in big fast routers because they have to take the slow route via CPU. As there's not a lot of use in accepting packets (externally at least) with IP options, they tend to be dropped totally (but will almost certainly be policed aggressively to the CPU as the CPU is not good for moving many packets).

> It sounds like iphones use mptcp in the wild, which use tcp options, so im not sure how true this is.

There's so much commentary misunderstanding what ip-options are that I find it difficult to make any judgement call. I do know that I've got routers on 5 continents with hundreds of public IPs and none have triggered an IP packet with an ip-option arriving on the WAN side, or seen on the internal side other than ones I've created with scapy trying to reproduce this. I also can't get these packets to traverse any internet paths I've tried.

Who demonstrated getting root with it? The last I've seen was "trust me bro".

Anthropic claims they have and they havn't been caught in a lie about this sort of thing yet. From a theoretical perspective, if a memory safety vulnerability in kernel network stack is exploitable, then root access would be the endgame so it fits.

Asked claude/haiku5.5 to review that cve against my server, docker images. Claude had passwordless ssh access to that server and no root access. It did the review, confirm that server has the volubility, asked me to ran a few sudo commands, give it the output. It asked me to run a command to disable mptcp option.

I then asked it to do complete cve reviews on the host server (U 26.04 was installed a few weeks back) and docker images on that server and update the security review and added a task to do daily check on ubuntu website on kernel security update.

EDIT: Just asked claude if it can write a patch and build a image on top and fixed the issue on my server. It said it can. And point out that it can apply the 2 lines patches https://github.com/torvalds/linux/commit/e3f33b0.patch and build a kernel image on this issue for me. FYI....

So it's indeed "trust me bro!".

What exactly do you expect them to do? Publish the exploit that can root a huge proportion of all linux servers?

Presumably they will publish it with sufficient fanfare once patches are applied widely enough.

Reply on news.ycombinator.com