← Back to context

Comment by gerdesj

11 hours ago

Quite, however it looks quite rare:

"Why it's urgent: the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection. Anthropic, whose researcher reported it, says its Claude model wrote a working proof-of-concept exploit that runs commands as root on "Linux servers with a multipath TCP listener," with no credentials. Go programs open those listeners by default, per the Go Security Team. See the timeline."

I don't know of any Linux boxes running a multipath TCP listener in my care and I have quite a few. MP generally implies a router of some sort and the intersections in a Venn diagram continue to get smaller ...

This is still an issue and must be patched but I think it will be rare, very rare.

9 comments

gerdesj

Reply
reissbaker  11 hours ago

This is not rare. Every TCP connection in Go by default enables MPTCP [1]. Simply running a Go program that uses TCP without explicitly disabling this behavior will cause the running kernel to be vulnerable.

1: https://groups.google.com/g/golang-announce/c/PCoQcdxoScw

  • dada216  33 minutes ago

    the default on all of my RHEL is to have it disabled, I believe it's the same on Debian based

    sysctl -a | grep net.mptcp.enabled net.mptcp.enabled = 0

    and golang apps would just gracefully downgrade to non mptcp in that case.

  • Eueudhsbsj32  3 hours ago

    But any sane configuration would have the MPTCP port blocked behind a firewall (unless you were intentionally using MPTCP).

    • hnlmorg  2 hours ago

      > MPTCP port blocked

      MPTCP doesn’t use any specific ports. It’s an OSI layer higher than that. It’s part of the TCP protocol itself. So if your firewall routes TCP traffic of a specific port (eg HTTP) already then it’ll route MPTCP along with it too.

      1 reply →

compumike  9 hours ago

Try:

  sudo ss -lnp -A mptcp

to check. If you're running any Go code, you may be surprised. I was.

TZubiri  9 hours ago

It seems like the anthropic PoC involves MPTCP, but the bug itself is not in the MPTCP code, it's in a generic TCP codepath relating to options, MPTCP was probably just a convenient codepath for memory manipulation.