logoalt Hacker News

wiskinator • today at 7:58 PM • 2 replies • view on HN

> Anthropic says Claude wrote the exploit "after initial prompting," that it runs "arbitrary commands as root, without any credentials or user interaction" on servers with a multipath TCP listener, and that in its proof of concept "it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution."

This is wild. I'm a firmware nerd, not a backend nerd, what percentage of TCP/IP servers are 'multipath'?

Also, since IPv6 isn't affected, wouldn't it be funny if this is what it took to get everyone to switch.


Replies

cataflam • today at 8:05 PM

> what percentage of TCP/IP servers are 'multipath'?

no idea, but at least Tailscale and Caddy were opening MPTCP sockets on servers I checked.

dist-epoch • today at 8:04 PM

My understanding is that an app explicitly needs to open a "multipath" socket. Go 1.24 does that by default, so does Caddy, these would be the big ones.

➕ show 1 reply