logoalt Hacker News

cowlevel • yesterday at 9:05 PM • 1 reply • view on HN

Do apps actually use this possibility though?


Replies

ButlerianJihad • today at 6:04 AM

MPTCP is an extension that requires cooperation. So it is only supported if the network stacks of both peers and all middleboxes can support it. The Linux kernel docs describe it as "opt-in", so it is not enabled by default for every socket opened on the system.

Again, the description of this CVE indicates that the vulnerability does not depend on MPTCP. But it is a factor in the proof-of-concept and its likelihood of success.

So if there was any widespread mutual support of MPTCP, it may shrink significantly as network admins deploy mitigations.