Is it a cause of concern? Yes. Will you get hacked? Most likely not.

Most consumer routers run ancient stacks with all kinds of weird proprietary vendor patches that are tied to a specific kernel version. Looking at you Qualcomm!

However they generally also drop all traffic by default so from the WAN side they look like a black hole. I guess that's "safe" enough for most consumers.

For fun, take a look at the open PRs in the OpenWRT repos. Those people are doing some amazing work but it's also frustrating to see them struggle with things that _could_ be easy if the vendor made some slightly better choices.

I would strongly prefer something like OpenWRT though. Call me paranoid but after the last few weeks I'm increasingly less comfortable with connecting my devices to a blackbox.

▲

majorchord 2 hours ago | parent | next [-]

I know the context here is consumer routers, but for those reading who might be running a server, or a homelab, or anything that does accept connections from outside, I want to make it clear that "most likely not" turns into "likely trivial if targeted" for servers.

▲

dwedge 2 hours ago | parent | next [-]

Can you give examples of kernel bugs that can be targeted on an otherwise locked down system? Let's say something running just LAMP and all other ports closed off with a software firewall. Even the one in this article seems very tricky to actually exploit.

There are plenty of out of support systems still in the wild and while I'm not arguing they are completely secure I was under the impression that kernel vulnerabilities generally make a minor exploit in something else worse (chained priv escalation for example) and generally are difficult to exploit on their own. If I'm mistaken I'd love to know

	▲	majorchord an hour ago \| parent \| next [-]
		Any TCP packet (with IP options) you can send to a Linux kernel that doesn't get DROP'd by netfilter makes you technically vulnerable. That includes the one port your LAMP stack uses. Or, the attacker might be originating from the other side of a device, like within a LAN. Malicious employees/house guests/what-have-you could target devices from inside your network where most devices (not just servers) don't have as much protection and often have other open ports accessible, like file sharing/SMB, SSH, SMTP, RDP, databases etc.
	▲	cjbprime an hour ago \| parent \| prev [-]
		Does the bug we're talking about not count as an example for some reason?

▲

harry8 an hour ago | parent | prev [-]

Don't a lot of consumer routers allow for remote connection for tech help trouble-shooting?

How about forwarding a port for wireguard or ssh?

▲

j45 20 minutes ago | parent | prev [-]

It's a massive risk, and only a matter of time. Especially for hardware that's no longer updated firmware wise.

I'm thinking of what to do myself.

The ghost of android releasing 6 month old patches every month is going to come home to roost.