Hacker News

points by imjonse 1 day ago | 0 comments

Has there been a documented exploit of this CVE on Ubuntu or on the other distros before they were patched?

[–] talon8635 1 day ago

Here’s the real answer. It’s not as scary as the original reporters made it out to be.

[–] 1over137 1 day ago

Then why is it rated 9.8? (Including by Ubuntu itself)

[–] talon8635 9 hours ago

It’s not by RedHat. Does Ubuntu provide its own independent research and scoring?

[–] fwlr 1 day ago

Because the rating system is not very good.

[–] arto 1 day ago

See here: https://x.com/mattiasgeniar/status/2118040483154755627

[–] vdfs 1 day ago

tldr: DoS and not RCE

[–] wtch98 1 day ago

I haven't had a documented packet with IPOptions arrive on any of my firewalls, the packets are typically dropped, so exploiting remotely is going to be very difficult. In theory you could use another exploit and then lateral move in some networks which don't drop them at a router level.

[–] wredcoll 1 day ago

Yeah, had this ever actually been proven in the "real world"?

[–] cromka 1 day ago

Does it have to be? I am betting there's more people working on proving this and not disclose the proof than to do.

[–] wredcoll 14 hours ago

It doesn't have to be, but it's getting a bit weird that everytime this subject comes up nobody has an actual example.