>the kernel handed those saved options from the request socket to the new connection without copying them, then freed them immediately when the connection went away, while another CPU could still be reading them to build a handshake reply.
If this requires a multi-core system to exploit, it's good news for most of the consumer routers that will never get updates. Saved by cheap single-core hardware.
You would be surprised. A lot of cheap consumer routers are have two or four ARM cores. The bigger issue is that they are typically running a kernel from the stone age (< 6.0.0). Sometimes a still-supported LTS kernel like 5.10 or 5.15, but then they stopped at an old patch level.
Heck, apparently even the new Unifi UCG Fiber is running 5.4.213 (September 2022), but maybe they backport some fixes?
[1] https://community.ui.com/releases/dd0283dc-bf71-4140-ae1d-c1...
loading story #50320782
loading story #50322068
My $50 router has two cores.
root@OpenWrt2:~# lscpu
Architecture: mips
Byte Order: Little Endian
CPU(s): 4
On-line CPU(s) list: 0-3
Model name: -
Model: MIPS 1004Kc V2.15
Thread(s) per core: 2
Core(s) per socket: 2
Socket(s): 1Those routers probably have 20 other critical un-patched exploits ...
An entire ecosystem of malware crawling and cohabiting in them.
{"deleted":true,"id":50321881,"parent":50319518,"time":1793496052,"type":"comment"}