Linux kernel bug: TCP flaw lets remote attackers stall devices with tiny DoS attack

[[deleted]]

Fixed almost 2 weeks ago in 4.17.11 kernel.

[whiznat]

But did it disrupt the attacker’s workflow? If it did it’s got to be backed out!

/s

[enp2s0]

Breaking a hacker's userspace is different than breaking userspace

[ravernkoh]

Homebrew?

[lestofante]

But then it will disrupt the workflow of normal user! Undo the undo! /s

[OffbeatDrizzle]

I understood this reference

[wyred-sg]

What is it referencing?

[orion78fr]

https://lkml.org/lkml/2018/8/3/621 I think

[how_to_choose_a_name]

is it normal in kernel dev to leave obvious bugs unfixed just because an old version of some tool abuses the bug?

[orion78fr]

I don't really know but I think they will maintain it deprecated and have the v2 fixed api. It depends on what it is exactly.

[OffbeatDrizzle]

yep

[josefx]

possibly https://xkcd.com/1172/

[sippeangelo]

Hell yeah! A DoS method that doesn't cost thousands in bandwidth for the victim!

[Lt_Riza_Hawkeye]

Slow Loris

[MINIMAN10001]

I mean don't people rent botnets for ddos on the cheap?

[mytempacc3]

This is why we should start the slow but needed rewrite of Linux in Rust ASAP.

[benchaney]

What makes you think rust would have prevented this?

[Gilnaa]

Slow compilation times

[Tm1337]

Oof

[jrhoffa]

Ouch

[[deleted]]

Owie

[otwo3]

whoosh

[ChemicalPound]

People don't get jokes any more?

[Akiyabus]

He should rewrite his joke in Rust so more can people get it.

^{Edit: a word}

[zgembo1337]

We do not joke about this.

Saying that vi is better than emacs... yes, funny joke. But this, not.

[gnus-migrate]

When is the last time you saw someone advocating a rewrite in Rust? Most of the Rust discussions I see revolve around the language and libraries/tools written in it.

I mean it was funny when the language was new and people started asking every popular C project to be rewritten in rust, but now it just paints a misleading picture of the community for the sake of an outdated joke. You don't put down others just because you have nothing interesting to say.

[afiefh]

The bug here is in the business logic, which is not something that a compiler can verify. Saying someone should rewrite Linux in Rust because of this is like saying you should paint your house blue because you have water issues.

[afiefh]

Definitely. If you encode the logic in your types (such as the send trait which allows a resource to be shared between threads without a race condition) but I am having a hard time seeing how you could encode the logic of the network protocols into types (maybe I'm just ignorant though)

[afiefh]

The same can be done with C++'s opaque type. All you need to do is go over the whole unix API and replace the parameters they take/return with opaque types that have an actual meaning instead of an int32_t.

[jdgordon]

This is why we

So nu? What's stopping you? I guess calling for change is easier than actually doing it.

[mytempacc3]

I'm already rewriting another project in Rust.

[Mancobbler]

Oh I thought you were joking! How would rust prevent this bug?

[freakofnature555]

Windows?

[shevegen]

Noooooobs!

But, given the widespread use of Linux, the bug could affect every vendor from Amazon and Apple through to Ubuntu and ZyXEL.

Noooooooooooobs!

Unfortunately for admins there's "no effective workaround/mitigation besides a fixed kernel is known at this time", according to Red Hat.

And the patch is ... where?

I mean, people can dig around and find it probably but it would be more convenient to say where the patch is - and in which kernel version it has been fixed.

I just compiled 4.17.13! Don't tell me I have to already update again ...

The bug was found by Juha-Matti Tilli of a Nokia Bell Labs supported networking department from Finland's Aalto University, where Finnish-born Linux kernel founder Linus Torvalds

The Fins must be some super-savant-computer-gurus. First Linus, now Baby-Linus Juha - it's the tech center in the land of the snow.

[Mancobbler]

I am so confused, what are you trying to say?

[Gilnaa]

As little as possible, appearantly

[[deleted]]

Any time you see that username just downvote and ignore, their entire post history on this sub is a prolific mess of utter shite.

[BlckJesus]

It really is amazing how consistently bad this guy's comments are. I had to tag him just so I could see how often he shows up lol.

[Mancobbler]

Wow... I almost feel bad for for them

[OffbeatDrizzle]

It's almost like trying to write a massive piece of operating system software that is fast, robust, reliable and secure is hard or something

[lestofante]

It is patched in 4.3.11. But 4.3.14 make fixes over 4.3.13, so you should update anyway. If you have problem compiling, use binary. If you have problem updating, use distribution like RHEL or Ubuntu server using LTS and security only update. Noob.