4 ms·

A whitepaper detailing this CVE-2022-32296 attack. Vulnerability is in Double-Hash Port Selection (DHPS, IETF RFC 6056) Fixed in Linux 5.17.9 and above using

A whitepaper detailing this CVE-2022-32296 attack. Vulnerability is in Double-Hash Port Selection (DHPS, IETF RFC 6056) Fixed in Linux 5.17.9 and above using a variant of DHPS. Linux sysctl: net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 Also Firefox Only HTTPS must be enabled to prevent JavaScript from performing dwell on hidden unsecure HTTP DOM frame. ---- https://support.mozilla.org/mk/questions/1359401 https://support.mozilla.org/mk/questions/1359401 https://arxiv.org/pdf/2209.12993 https://arxiv.org/pdf/2209.12993 https://github.com/0xkol/rfc6056-device-tracker https://github.com/0xkol/rfc6056-device-tracker https://www.rfc-editor.org/rfc/rfc6056.html https://www.rfc-editor.org/rfc/rfc6056.html

sambazi 2y ago
there is probably a reason that rp_filter defaults to off though
- chatmasta 2y ago
  Yes, I think disabling it allows for more hole-punching techniques, since you can basically maintain a TCP connection indefinitely and across network connectivity changes.
  - sambazi 2y ago
    iirc more like that you basically need the 'loose mode' because most cpe's are bridging wireless and wired networks, but this then won't protect against the more serious shenanigans