Have companies been compromised because of this vulnerability? Ubuntu has an absolutely massive install base. The lack of notable incidents suggests that 9.8 might not reflect real-world well.

Maybe it's time for StealMyBitcoinV2…

▲

grey-area 4 hours ago | parent | next [-]

I think the official CTF is up here:

https://ubuntu.com/security

server: nginx/1.14.0 (Ubuntu)

	▲	ChromeUltron 3 hours ago \| parent [-]
		^this sure made my day, lol thanks for that :)

▲

vikramkr 5 hours ago | parent | prev | next [-]

If someone does a v2 let's hope they make sure it's actually exploitable when they set it up so they don't leave hundreds of people with the assumption that the cve is not a big deal when the CTF was just misconfigured and the system got pwned in less than 2 hrs after they fixed it

▲

mzhaase 5 hours ago | parent | prev | next [-]

CVSS in general is not the best proxy for "real world impact". You could have a 10 on a software thats only deployed once and the impact would be tiny. In this case, multipath is not used that much (except by go).

▲

vbezhenar 4 hours ago | parent [-]

Go is everywhere in server environment. It's absurd to claim that multipath is not used that much. Maybe it's me, but go literally everywhere around me.

Also this vulnerability is not strictly about mptcp, although the exploitability is not clear.

	▲	ASalazarMX 3 hours ago \| parent \| next [-]
		But they have very valid point: a CVE 10.0 with root RCE on twenty internal servers is lower risk than one vulnerable internet-facing server. All need to be patched, but the one on the Internet is your critical risk, the others are medium at worse.
	▲	cpncrunch 2 hours ago \| parent \| prev [-]
		It's trivially easy to disable multipath in Go.

▲

rcxdude 5 hours ago | parent | prev | next [-]

I think it's less of a concern over the internet because the kind of packet necessary for the exploit tends to be filtered out, but it's pretty scary as an escalation mechanism from e.g. an end-user device to a core server.

Much like with PHP2Shell, it doesn't need to be utterly trivially exploitable to be a big concern.

▲

1970-01-01 4 hours ago | parent | prev [-]

Contrast this with: "The Gift of It's Your Problem Now"

We keep doing this to ourselves. Heads should roll at Ubuntu. Start that process right now? You can't. You see, nobody is directly available to sue. It does seem that nobody ever truly cared about that. The insecure codebase and tech debt shall continue to grow because that is the gift.

https://apenwarr.ca/log/20211229-the-gift-of-its-your-proble...