3 ms·

Linux and FreeBSD: Multiple TCP-based remote denial of service vulnerabilities

83 points by punnerud 7y ago

d33 7y ago
Nice! Didn't know it was Netflix who caught this. I wonder how they did this - fuzzing perhaps? Curious how difficult it would be to employ a genetic fuzzer like afl-fuzz to look for such bugs.
- deleted 7y ago
  [deleted]
- vardump 7y ago
  > I wonder how they did this - fuzzing perhaps? That, reviewing/auditing kernel code or they got hit with it.
wills_forward 7y ago
Every time I see one of these systemic vulnerabilities get found I wonder how many others someone (or some entity) are just sitting on until they REALLY need to use it. Someone tell me it’s all going to be okay and this digital world isn’t going to just crumble someday. Please. Anyone.
- staticassertion 7y ago
  There are entities out there sitting on hundreds of 0days. Governments buy hundreds every year. Things aren't really getting much better either, so yeah, could totally crumble.`
- Scoundreller 7y ago
  Reminds me of a (now defunct) computer un-conference I went to about 8 or 9 years ago. I left fulfilled and defeated by how vulnerable everything seemed. Whenever I went to a “professional” conference in my field from then-on, I just felt disappointed in how little I got to learn.
WalterSobchak 7y ago
Discussion from yesterday: https://news.ycombinator.com/item?id=20205566 https://news.ycombinator.com/item?id=20205566
michaelngagnon 7y ago
In 2010, I recommended ballistic-missile-defense systems run their servers under both Linux and FreeBSD to mitigate the risk of kernel-level remote DoS 0-days [1]. Now it looks like N-version programming has failed yet again [2]. [1] http://michaelgagnon.me/file/isarcs.pdf http://michaelgagnon.me/file/isarcs.pdf [2] https://en.wikipedia.org/wiki/N-version_programming https://en.wikipedia.org/wiki/N-version_programming
- sjackso 7y ago
  I read the situation as being worse for Linux (3 CVEs, including one remotely-inducable kernel panic, spanning many versions) than for FreeBSD (1 CVE that can be exploited to slow down a target system in the latest major version). But even granting that both affected OS flavors have serious DoS issues, a service that used a mix of OS flavors in its servers would be more resistant (not impervious) to attacks based on these TCP problems than a service using only one flavor. So do you really count this as a failure of N-version programming? (Honest question! This is not my area of expertise.)

83 points by punnerud 7y ago

d33 7y ago

Nice! Didn't know it was Netflix who caught this. I wonder how they did this - fuzzing perhaps? Curious how difficult it would be to employ a genetic fuzzer like afl-fuzz to look for such bugs.

deleted 7y ago
[deleted]
vardump 7y ago
> I wonder how they did this - fuzzing perhaps? That, reviewing/auditing kernel code or they got hit with it.

wills_forward 7y ago

Every time I see one of these systemic vulnerabilities get found I wonder how many others someone (or some entity) are just sitting on until they REALLY need to use it. Someone tell me it’s all going to be okay and this digital world isn’t going to just crumble someday. Please. Anyone.

staticassertion 7y ago
There are entities out there sitting on hundreds of 0days. Governments buy hundreds every year. Things aren't really getting much better either, so yeah, could totally crumble.`
Scoundreller 7y ago
Reminds me of a (now defunct) computer un-conference I went to about 8 or 9 years ago. I left fulfilled and defeated by how vulnerable everything seemed. Whenever I went to a “professional” conference in my field from then-on, I just felt disappointed in how little I got to learn.

WalterSobchak 7y ago

Discussion from yesterday: https://news.ycombinator.com/item?id=20205566 https://news.ycombinator.com/item?id=20205566

michaelngagnon 7y ago

In 2010, I recommended ballistic-missile-defense systems run their servers under both Linux and FreeBSD to mitigate the risk of kernel-level remote DoS 0-days [1]. Now it looks like N-version programming has failed yet again [2]. [1] http://michaelgagnon.me/file/isarcs.pdf http://michaelgagnon.me/file/isarcs.pdf [2] https://en.wikipedia.org/wiki/N-version_programming https://en.wikipedia.org/wiki/N-version_programming

sjackso 7y ago
I read the situation as being worse for Linux (3 CVEs, including one remotely-inducable kernel panic, spanning many versions) than for FreeBSD (1 CVE that can be exploited to slow down a target system in the latest major version). But even granting that both affected OS flavors have serious DoS issues, a service that used a mix of OS flavors in its servers would be more resistant (not impervious) to attacks based on these TCP problems than a service using only one flavor. So do you really count this as a failure of N-version programming? (Honest question! This is not my area of expertise.)