In mid-October, a serious security vulnerability at the heart of Linux was disclosed that affects many of the servers on the internet. An attacker needs neither a password nor access to crash a server or, in the worst case, even take it over: a few crafted data packets are enough. Updates are not yet available for some of the most widely used Linux systems.
The good news is that Link11 Network DDoS Protection‘s filters consistently identify and mitigate the specific characteristic of the packets required for the attack.
At a glance:
- What: A flaw in the Linux kernel, which is the core of the operating system.
- Who: Practically every Linux server reachable via IPv4 from the internet.
- Impact: a crash; in extreme cases a takeover of the server.
- Protection: a kernel update, as well as a network filter to prevent dangerous packets from entering in the first place.
What is behind it?
Much like the address field on an envelope, every data packet on the Internet has a header. In addition to the sender and recipient information, the old Internet Protocol (IPv4) allows for optional additional information known as IP options. These options date back to the early days of the internet and were used to record the route a packet took, for example. Today, practically no one uses them anymore.
At the same time, this additional information is the lever for the attack. When a server accepts a new connection, it briefly stores this information as a note. Modern servers handle many tasks simultaneously on multiple processor cores. If an attacker sends a connection request several times in quick succession, one core may have discarded the note while another is still reading it.
Experts call this a “race condition”: a race between two processes in which timing determines the outcome. The result is known as a “use-after-free.” The system accesses memory that it has already released and that may be in use for something else.
Timing it just right does not work every time. However, this is not much of an obstacle for the attacker, since they can simply try again in quick succession.
In the most harmless case, the server crashes. In the worst case, however, the attacker can read or modify memory they should not have access to. The fix from the Linux developers now ensures that the note is only discarded once nobody is reading it anymore.
How dangerous is it?
Assessments differ. While Linux developers rate the vulnerability as critical, major Linux vendors consider it to be of medium to high severity. They are more restrained because hitting the right moment is difficult.
Nevertheless, Anthropic has shown that it is possible. The AI company discovered the vulnerability and developed a lab attack that completely and remotely takes over a server. This process took just under an hour and targeted servers with an additional feature called Multipath TCP. What makes this tricky is that failed attempts do not crash the server and therefore hardly attract attention.
So far, no real-world attacks are known. However, since the mechanism has been publicly described, it should not be relied upon.
Why it matters right now
The Linux developers fixed the flaw in early October. However, before the fix can reach a server, every Linux vendor must incorporate it into their own version and ship it.
Debian, SUSE, Oracle and Amazon have done so, at least for some of their systems. For Ubuntu and Red Hat Enterprise Linux, two of the most widely used server systems, there was still no update at the end of October, nor an officially recommended workaround. As a result, many operators cannot currently patch.
How Link11 protects
The attack only works if packets with this additional information reach the server. This is where our filters come in.
Our DDoS filters drop every IPv4 packet containing IP options before applying any other rules and without exception. Since normal traffic does not use these fields, no legitimate traffic is lost.
Therefore, every server whose traffic passes through our filters is protected against internet-based attacks, even while its operating system is waiting for an update.
This rule is not a reaction to this CVE, but rather, it is part of our basic configuration. IP options are not inherently dangerous, but they are unnecessary on today’s internet. This vulnerability demonstrates the importance of consistently filtering out protocol oddities before they can be exploited.
Learn how the new Network DDoS Protection protects you even more effectively
Faster mitigation, IPv6 parity, greater transparency, and significantly less manual effort.
Where no filter helps
A network filter only protects what passes through it. Therefore, an update is mandatory in several cases:
- Servers whose traffic does not pass through us. This applies to management and maintenance access, as well as to systems with their own internet connection that can be reached by bypassing upstream protection.
- Networks in which an attacker has already gained a foothold. For example, anyone who controls a device on the internal network can reach vulnerable servers without passing through an upstream filter.
- Servers that can be logged into by untrusted users. This vulnerability can be triggered from the inside and cannot be detected by any network filter.
What this vulnerability reveals about the future
This vulnerability was found by an AI. This is not an isolated case; language models are discovering vulnerabilities at an increasing rate. For companies, this means applying updates more frequently.
Those that already lack the capacity for patches and updates will face even greater pressure. While upstream network protection does not solve this problem, it does provide breathing room by keeping internet-based attacks at bay and allowing time to properly test and roll out patches and updates.
In the long term, however, the only solution is “secure by design,” which is also required by the EU Cyber Resilience Act (CRA). Memory errors like this one are common in older programming languages, such as C, which is used to write a large part of the Linux kernel. Newer languages, such as Rust, largely prevent such errors and are already used in the kernel. However, nobody rewrites existing code without good reason. That is why the basics remain crucial, above all, timely patching.
What we recommend
- Install the update as soon as your Linux vendor provides it.
- Check which servers are directly reachable from the internet without their traffic passing through network protection.
- Patch systems with many users or third-party code first, such as shared hosting or build servers.
For techies: the details in brief
- The IPv4 path in the TCP handshake is affected. The IP options of the pending connection request, such as Record Route or Timestamp, are handed over to the new socket without being copied. If another CPU core responds to a retransmitted SYN in parallel, a use-after-free error occurs.
- IPv6 is not affected because the options are copied there.
- The flaw has been in the kernel since Linux 4.4. The fix releases memory after an RCU grace period and is included in all maintained stable branches.
- CVSS: 9.8 according to the kernel CVE team; 5.9 to 8.1 according to distributors. The difference lies solely in how attack complexity is assessed.
- Anthropic’s exploit first bypasses KASLR via a memory leak, then overwrites a callback pointer. The targets were servers with an MPTCP listener. The code and test configuration have not been published.
Want to be sure your servers are fully protected? Contact our team at any time – we are happy to review your environment with you.
Not a Link11 customer yet? Get in touch to learn how our network protection can secure your systems before a patch is available.
You might also like:
