Validators associated with $SOL were urged to act immediately. Anza issued an urgent notice early this morning Beijing time, warning of a serious Linux kernel vulnerability and telling validators running on mainnet to take immediate action.
SOL is Solana’s native token, and Anza is the team that develops Agave, a Solana validator client.
The vulnerability affects how Linux handles TCP connection requests. The Linux kernel has already been patched, but Ubuntu has yet to release a fixed kernel version. This notice is specifically aimed at validators running Ubuntu.
The recommended workaround is to first block TCP packets with IP options, then disable Multipath TCP and TCP connection request migration until Ubuntu releases an official patch.
The urgency stems from the Linux kernel CVE team’s severity rating of 9.8 for this vulnerability. An attacker could potentially break in by sending packets remotely, without an account. Researchers have already demonstrated gaining root access on hosts with Multipath TCP enabled.
Validator machines store node identity and voting keys, so compromising one is no small matter. Vendors such as AWS say they have not yet seen the vulnerability being exploited in the wild.
SOL is Solana’s native token, and Anza is the team that develops Agave, a Solana validator client.
The vulnerability affects how Linux handles TCP connection requests. The Linux kernel has already been patched, but Ubuntu has yet to release a fixed kernel version. This notice is specifically aimed at validators running Ubuntu.
The recommended workaround is to first block TCP packets with IP options, then disable Multipath TCP and TCP connection request migration until Ubuntu releases an official patch.
The urgency stems from the Linux kernel CVE team’s severity rating of 9.8 for this vulnerability. An attacker could potentially break in by sending packets remotely, without an account. Researchers have already demonstrated gaining root access on hosts with Multipath TCP enabled.
Validator machines store node identity and voting keys, so compromising one is no small matter. Vendors such as AWS say they have not yet seen the vulnerability being exploited in the wild.