Ubuntu and RHEL lack fixes for a Linux TCP use-after-free that Anthropic says it exploited to run commands as root on MPTCP servers.
  • cron@feddit.org
    7·
    10 days ago

    Red Hat’s CVE page rates the flaw Moderate, scoring it 5.9 because the race is hard to win. It says the most likely result is a kernel crash, with memory corruption possible in theory, and that “no confidentiality or integrity impact has been demonstrated.”

    Oh thats great, it only crashes the kernel. /s

    • Lena@gregtech.eu
      15·
      10 days ago

      It’s fair (if their reasoning is correct, that is), crashing the kernel is preferable to RCE