[–] 21 points 2 weeks ago (3 children)

IPv6 is not affected by this race because the kernel copies the options for IPv6 connections.

It's been a slow-going effort to get a compile flag into the kernel that disables IPv4, but this is precisely the type of bug which that flag would have avoided. When devices choose to natively use IPv6-only -- eg IoT -- they really shouldn't have to also accept an increased attack surface from Legacy IP, something that is increasingly unnecessary.

Disabling IPv4 when it's unneeded is good security posture, but such a choice is not available yet in Linux.

  • source
  • [–] [S] 29 points 2 weeks ago (3 children)

    The score sounds a bit overblown considering this is for MPTCP which is as far as I understand rarely used? And it sounds like the chance of this leading to anything more than a crash is low. But whatever.

    It's a data race. Memory safety is still super important for security.

  • source
  • view more: ‹ prev next ›