alt Hacker NewsWow, that isn't clear. Is there an incident, or did they just become aware about MPTCP vuln? Details on the mptcp are also pretty scarce as well right?
Replies
Yeah its unclear. Sounds like they are just now patching it and treating it as an incident which is probably the right thing to do.
I am wondering if there is something significant written with Go in their system stack (Go uses MPTCP by default on listening sockets, it seems)
Yeah agreed. I actually only noticed because my two boxes are super slow and I've been troubleshooting for about an hour. Finally opened up the Customer Support page and this was the top incident.
I haven't seen any emails about it, so I'd lean towards it being something that doesn't rate sending emails.
Based on email I got from another big hosting provider, they're all patching for the same checksum metadata vulnerability (the CVE they mentioned is the same). There is however a root RCE PoC according to the researcher so...potentially bad.
It is almost certainly the latter, since it is another “Customer Security Advisory”. There is a currently open report for a tranche of nginx vulnerabilities[0] and a closed report for PwnEscape[1] and the PHP RCE[2] that are identical. The HN topic has been editorialised.
[0] https://status.linode.com/incidents/8dqqkh4d9y2c
[1] https://status.linode.com/incidents/zp71823t318w
[2] https://status.linode.com/incidents/wq8zlhk736fk