I have not seen an exploit in the wild. I have at least 20 different servers unpatched (obviously) but the risk is blown way out of proportion. There are a number of mitigation options available.

▲

majorchord 2 hours ago | parent | next [-]

> I have not seen an exploit in the wild.

How would you see one? Have you deployed your own army of honeypots that are actively logging and looking for corrupt IP options packets? If you're not already looking for it, I think it's very likely that most people who get hacked will have no way of knowing how it happened, so we can't consider those incidents as being a result of this particular bug.

Are you actually monitoring for this specifically or just trying to use a sample size of 1 group of servers to prove something?

▲

handoflixue 31 minutes ago | parent | next [-]

The recent wave of vulnerabilities has actually prompted a lot of people to set up honeypots, monitoring, etc. and the rate of actual exploits has been notably very low for the general public.

Most of the October CVEs we've seen were situations that require an extremely complex chain of attacks - amazing if you want to break into a bank, or fuck up some grocery freezers, not so useful for scanning random public boxes and doing "hacks of opportunity"

Apologies for the lack of links - it's a scattering of random people I've read talking about this, not any coordinated study. But if you read between the lines on all of the threads about these CVEs, you'll notice a lack of "I was hit by this" stories - which is pretty normal for more complex vulnerabilities.

The reason these sat unnoticed for so long is precisely because it's difficult to actually exploit them.

If anyone has anecdotes to the contrary, I'm definitely interested in hearing it, of course!

▲

pelagicAustral an hour ago | parent | prev [-]

Jesus H Christ! the bug is a narrow use-after-free race that needs SYNs carrying ipv4 options to make it to the box. I do not need an army of honeypots to tell you it most likely doesnt to have a way into a classic 443 machine... come on now.

▲

ranger_danger 24 minutes ago | parent [-]

Except I was able to use the PoC to exploit several of my "classic 443 machines" sitting on the internet, like millions of other servers out there.

	▲	evilDagmar 9 minutes ago \| parent [-]
		You had services running that actually use MPTCP?

▲

secabeen 3 hours ago | parent | prev [-]

Yeah, there's definitely more to the story about exploitability that Anthropic isn't telling us. RHEL didn't release a patch until yesterday either.

▲

worthless-trash 20 minutes ago | parent | next [-]

Rhel had patches on saturday.

▲

SP3269 3 hours ago | parent | prev [-]

“Definitely”. How exactly? Do you know something?

	▲	pelagicAustral 3 hours ago \| parent [-]
		I know something. Every fucking server with public facing infrastructure is not getting hacked left and right at the moment. So you make of that what you will, but in my experience it means the exploitation comes hand in hand with some far more esoteric chain that is not easy to put in practice.