Ubuntu and RHEL lack fixes for a Linux TCP use-after-free that Anthropic says it exploited to run commands as root on MPTCP servers.
  • Rimu ( rimu@piefed.social ) English
    30·
    6 days ago

    You can disable multipath TCP by issuing this command

    sudo sysctl -w net.mptcp.enabled=0

    persist across reboots with

    echo "net.mptcp.enabled=0" | sudo tee /etc/sysctl.d/99-mptcp.conf

    If your kernel is older than 5.6 then there is no multipath TCP to disable. e.g. Ubuntu 20.04 should be fine.

    • walderan ( walderan@sh.itjust.works ) 
      2·
      5 days ago

      Tacking this on here to increase visibility.
      You can see who is already listening to multipath TCP by running:

      ss -Mln

      running the sysctl command will prevent future ports being opened, but it will not close existing ones, you need to manually restart the services/containers.
      Go applications enable the functionality in their ports by default.
      My understanding is that a proper fix will come from a kernel update, since this affects plain TCP, but MPTCP has a known attack path.

  • SorteKanin ( SorteKanin@feddit.dk ) OP
    21·
    6 days ago

    The score sounds a bit overblown considering this is for MPTCP which is as far as I understand rarely used? And it sounds like the chance of this leading to anything more than a crash is low. But whatever.

    It’s a data race. Memory safety is still super important for security.

  • litchralee ( litchralee@sh.itjust.works ) English
    13·
    6 days ago

    IPv6 is not affected by this race because the kernel copies the options for IPv6 connections.

    It’s been a slow-going effort to get a compile flag into the kernel that disables IPv4, but this is precisely the type of bug which that flag would have avoided. When devices choose to natively use IPv6-only – eg IoT – they really shouldn’t have to also accept an increased attack surface from Legacy IP, something that is increasingly unnecessary.

    Disabling IPv4 when it’s unneeded is good security posture, but such a choice is not available yet in Linux.

    • Zykino ( Zykino@programming.dev ) English
      10·
      6 days ago

      On every embedded including a few IoT devices I worked on, every single time the IPv6 is either outright disabled, ignored, or treated like IPv4 even when telling my client what they want is not how IPv6 is designed.

      May not be the same everywhere, just my anecdotal experience.

      Also remember:

      The ‘S’ in IoT stands for security.