alt Hacker News> but this is a bug that could crash your system but is unlikely to expose your confidential system data to attackers
Given people have demonstrated getting root with it, unlikely seems questionable
> Especially given that the exploit can only be done if packets with IP options. IP options are commonly dropped or removed from packets on the open web.
It sounds like iphones use mptcp in the wild, which use tcp options, so im not sure how true this is.
Replies
> It sounds like iphones use mptcp in the wild, which use tcp options, so im not sure how true this is.
There's so much commentary misunderstanding what ip-options are that I find it difficult to make any judgement call. I do know that I've got routers on 5 continents with hundreds of public IPs and none have triggered an IP packet with an ip-option arriving on the WAN side, or seen on the internal side other than ones I've created with scapy trying to reproduce this. I also can't get these packets to traverse any internet paths I've tried.
Who demonstrated getting root with it? The last I've seen was "trust me bro".
TCP options are quite different from IP options.
IP options are annoying in big fast routers because they have to take the slow route via CPU. As there's not a lot of use in accepting packets (externally at least) with IP options, they tend to be dropped totally (but will almost certainly be policed aggressively to the CPU as the CPU is not good for moving many packets).