Wow, that isn't clear. Is there an incident, or did they just become aware about MPTCP vuln? Details on the mptcp are also pretty scarce as well right?
Wow, that isn't clear. Is there an incident, or did they just become aware about MPTCP vuln? Details on the mptcp are also pretty scarce as well right?
It is almost certainly the latter, since it is another “Customer Security Advisory”. There is a currently open report for a tranche of nginx vulnerabilities[0] and a closed report for PwnEscape[1] and the PHP RCE[2] that are identical. The HN topic has been editorialised.
[0] https://status.linode.com/incidents/8dqqkh4d9y2c
[1] https://status.linode.com/incidents/zp71823t318w
[2] https://status.linode.com/incidents/wq8zlhk736fk
Yeah its unclear. Sounds like they are just now patching it and treating it as an incident which is probably the right thing to do.
(Former akamai employee) Akamai have an incident process that handles both "things are bad for multiple customers" as well as "we need eyes on this from multiple departments/stakeholders asap". If you're hitting a wall debugging an issue on your own, especially if it's not overtly customer impacting, declaring an incident is an effective way of getting the attention needed to solve it.
Once you declare the incident, the process includes these status page updates, alongside equivalent internal status updates.
In this case, they probably wanted to maximise coordination, so used the process designed for that.
Also a former Akamai employee.
I left because I didn't like the pressure / pager duty, but I seriously respect how smooth and well thought out their operations were.
I am wondering if there is something significant written with Go in their system stack (Go uses MPTCP by default on listening sockets, it seems)
Based on email I got from another big hosting provider, they're all patching for the same checksum metadata vulnerability (the CVE they mentioned is the same). There is however a root RCE PoC according to the researcher so...potentially bad.
Yeah agreed. I actually only noticed because my two boxes are super slow and I've been troubleshooting for about an hour. Finally opened up the Customer Support page and this was the top incident.
I haven't seen any emails about it, so I'd lean towards it being something that doesn't rate sending emails.