Some notes I've got about this:

- MPTCP is not a requirement, it is a generic use-after-free.

- Exploitability over the internet is unlikely, most ISP routers drop packets with IP options fields.

- At least according to Red Hat, dropping packets with IP options yourself helps, but is not a full mitigation.

- Successful exploit requires multiple CPU cores to process packets, so systems with just a single core or packet processing pinned to a single core are not affected.

▲

tptacek 2 hours ago | parent | next [-]

Dropping packets with IP options from XDP should be a more complete mitigation (also more performant).

▲

wahern 2 hours ago | parent | prev | next [-]

> Exploitability over the internet is unlikely, most ISP routers drop packets with ipoptions fields.

That doesn't track. Apple iPhones are a major user of MPTCP and they report the majority of requests supporting MPTCP, IIRC 70+%.

	▲	peanut-walrus 2 hours ago \| parent [-]
		MPTCP uses TCP options fields, the vulnerability is in IP options.

▲

lossolo an hour ago | parent | prev [-]

And it takes around an hour to do this in lab setting locally:

> An enabling property of this race condition is that a lost race only fails the handshake without crashing the whole system, so a determined attacker can retry indefinitely until they succeed. In our proof of concept, it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution

source: https://www.anthropic.com/research/discovering-vulnerabiliti...