I know the context here is consumer routers, but for those reading who might be running a server, or a homelab, or anything that does accept connections from outside, I want to make it clear that "most likely not" turns into "likely trivial if targeted" for servers.

▲

dwedge 2 hours ago | parent | next [-]

Can you give examples of kernel bugs that can be targeted on an otherwise locked down system? Let's say something running just LAMP and all other ports closed off with a software firewall. Even the one in this article seems very tricky to actually exploit.

There are plenty of out of support systems still in the wild and while I'm not arguing they are completely secure I was under the impression that kernel vulnerabilities generally make a minor exploit in something else worse (chained priv escalation for example) and generally are difficult to exploit on their own. If I'm mistaken I'd love to know

	▲	majorchord an hour ago \| parent \| next [-]
		Any TCP packet (with IP options) you can send to a Linux kernel that doesn't get DROP'd by netfilter makes you technically vulnerable. That includes the one port your LAMP stack uses. Or, the attacker might be originating from the other side of a device, like within a LAN. Malicious employees/house guests/what-have-you could target devices from inside your network where most devices (not just servers) don't have as much protection and often have other open ports accessible, like file sharing/SMB, SSH, SMTP, RDP, databases etc.
	▲	cjbprime an hour ago \| parent \| prev [-]
		Does the bug we're talking about not count as an example for some reason?

▲

harry8 an hour ago | parent | prev [-]

Don't a lot of consumer routers allow for remote connection for tech help trouble-shooting?

How about forwarding a port for wireguard or ssh?