Hacker News Reader

Comment by chasil | Hacker News Reader

RedHat's mitigation is this:

  $ cat /etc/modprobe.d/dirtyfrag.conf
  install esp4 /bin/false
  install esp6 /bin/false
  install rxrpc /bin/false

Are those correct for this exploit?

Yep, that's the advice from AWS for the previous set of vulnerabilities:

That one also includes disabling user namespaces. Could be problematic if they're in use.

I don't know, but the problem with blocking esp4 and esp6 is that IPsec stops working, as I understand it.

For those who can I would recommend upgrading to Wireguard.