| ▲ | ay 3 hours ago | |
Just block the ingress IPv4 packets with IP options using nftables or iptables and move on. Why does everything has to come with so much drama these days. | ||
| ▲ | majorchord an hour ago | parent | next [-] | |
Red Hat claims[1] that's not enough: > The following nftables table drops incoming IPv4 TCP packets that contain IP options, which reduces exposure to this vulnerability but cannot fully prevent it. I suppose locally-running malicious programs could send packets to the loopback address or one of its own IPs or something. [1] https://access.redhat.com/security/vulnerabilities/RHSB-2026... | ||
| ▲ | cpburns2009 an hour ago | parent | prev [-] | |
I know that's one mitigation technique, like disabling mptcp does. But does that fully prevent this exploit? | ||