Every consumer router-wirelessAP I've seen runs linux.
I never see security upgrades for the kernels they use. Not one. Not ever.
Is this something that should be a cause for concern? Even if you don't run a consumer-grade tplink, netgear, asus, whatever router yourself.
Update:
The context which I should have said is that I think
LLMs are giving script kids nation state level tools and expertise. This known bug is always less interesting than the next twenty.
500+ Euros, 10G, Linux containers, that just is not targeted at consumers. My guess the number of people who have one of these in their home is very few indeed.
We're talking about the 500 million? A billion? more? Households with a consumer internet wirelessAP/Router with a public IP. Turris may be wonderful and i wish you the best of luck but in its present form it appears to be no part of the solution, sadly.
Enthusiasts and self-hosters, or just demanding users, are consumers too.
There are different kinds of consumer products. Some are simplistic and some have lots of features. Some are cheap and some are not. Some are slow and some are fast. Some are mass-produced and some are not.
For instance, there are Asus ROG routers with 25G, Samba, network drive, WireGuard etc. for over €700 and they're still consumer products. And I'm pretty sure those are not used in that many households either.
All of the Turris' product pages mention home usage. They also mention small business and office, which is expected for SOHO products.
To be frank, until today I thought that SOHO is a category of consumer products, but apparently it is not, so it looks like they target both.
I agree that this kind of devices is out of reach for many people, but it was not the topic until now.
I'm not affiliated with Turris in any way, so no need to wish me luck on this matter, but thanks anyway!
Mosty probably: not. Traffic passes throught the ASIC, usually it is not processed on CPU or custom code. Unlike typical web servers, that reduces the attack surface as there aren't software parsers (a common place where vulnerabilities hide). Additionally the OS may have additional protection measures, such as signing each binary, signing the booting image and limiting which syscalls can be done by any binary.
> Additionally the OS may have additional protection measures, such as signing each binary, signing the booting image and limiting which syscalls can be done by any binary.
I'd love for that to be true. Unfortunately, a lot of consumer routers are fairly straightforward Linux systems with no particular attempts at hardening.
I'm not sure. Maybe it would; maybe the IP options would make the packet bypass offload and get processed by the kernel. Either way, I wouldn't want to rely on hardware NAT offloading as a security feature.
The bug in question is not mitigated by any userspace actions (like signing binaries or boot images) or even by limiting syscalls, and all it takes is a listening socket on the device from either direction (inside or outside the network) to get root since router-destined packets are always processed by the CPU.
All traffic? In particular, I'd expect new connection establishment to go through a software path, looking up port forwarding and firewall rules etc. and creating hardware forwarding table entries if applicable.
This is one of the biggest benefits of using OpenWRT. They update the entire stack like every other month or so you’re never on an ancient kernel or utils.
The downside is it warns me if I update things will probably break and to take a backup, I've always been wary of updating my openwrt router because of that.
According to its logs, my bargain basement Huawei 4G router from 2019 got an update last week.
I hope that most of these devices actually do update themselves automatically, and people just aren't noticing. (Whether the updates are any good is another matter!)
You may want to try to look at Gl.inet routers. I'm not sure yet what is their modus operandi, but at least Flint 2 has both their official firmware (with Mediatek's SDK, I guess) and a vanilla Openwrt version -- on their company page.
Their features (Glinet's mesh) are not compatible but it does seem better than just drop support totally.
There also seems to be some involvement in the upbringing of openwrt support -- so it's not a hands-off approach, but on the other hand I'm only looking at Flint 2 firmware/OS development.
Additionally, their Flint 3e uses Qualcomm so the route it takes may be different -- though I hope not!!!
Now, if we are talking about my ISP router/modem....... I'd rather not think about it.
PS: Gl.inet also has a router with fiber optic. Not sure how that would work if I wanted to throw my ISP's router/modem out the window.
Google Wifi used to be good about that. I even got a notification for when my AP was being EOL'd and would no longer receive automatic firmware updates. I don't know if Google is still on the ball there. The Nest acquisition was confusing. Have the Google Wifi and Nest Wifi teams been merged?
But FWIW I run my AP in bridge mode. Wifi drivers and chip firmware seem to be riddled with exploits. I don't want my router & firewall on the same system as the AP.
While it's certainly not the right product for the openwrt crowd wanting to flash their own firmware and look under the covers, I wouldn't work here if we were obviously doing such things to the degree your comment implies.
Is it a cause of concern? Yes. Will you get hacked? Most likely not.
Most consumer routers run ancient stacks with all kinds of weird proprietary vendor patches that are tied to a specific kernel version. Looking at you Qualcomm!
However they generally also drop all traffic by default so from the WAN side they look like a black hole. I guess that's "safe" enough for most consumers.
For fun, take a look at the open PRs in the OpenWRT repos. Those people are doing some amazing work but it's also frustrating to see them struggle with things that _could_ be easy if the vendor made some slightly better choices.
I would strongly prefer something like OpenWRT though. Call me paranoid but after the last few weeks I'm increasingly less comfortable with connecting my devices to a blackbox.
I know the context here is consumer routers, but for those reading who might be running a server, or a homelab, or anything that does accept connections from outside, I want to make it clear that "most likely not" turns into "likely trivial if targeted" for servers.
Can you give examples of kernel bugs that can be targeted on an otherwise locked down system? Let's say something running just LAMP and all other ports closed off with a software firewall. Even the one in this article seems very tricky to actually exploit.
There are plenty of out of support systems still in the wild and while I'm not arguing they are completely secure I was under the impression that kernel vulnerabilities generally make a minor exploit in something else worse (chained priv escalation for example) and generally are difficult to exploit on their own. If I'm mistaken I'd love to know
Any TCP packet (with IP options) you can send to a Linux kernel that doesn't get DROP'd by netfilter makes you technically vulnerable.
That includes the one port your LAMP stack uses.
Or, the attacker might be originating from the other side of a device, like within a LAN. Malicious employees/house guests/what-have-you could target devices from inside your network where most devices (not just servers) don't have as much protection and often have other open ports accessible, like file sharing/SMB, SSH, SMTP, RDP, databases etc.
AFAIK all the backdoors which have been found in some models are only accessible from the LAN side, and if you have an attacker inside the network, it's already too late.
> if you have an attacker inside the network, it's already too late.
It shouldn't be though. Just because my smart lightbulb has an RCE and is isolated on its own VLAN with the router doesn't mean it should be able to attack the router and escalate to access my devices on other VLANs. It should only be able to do damage limited within its own vlan.
> if you have an attacker inside the network, it's already too late.
Disagree, I think it's still a good idea to try to mitigate e.g. root escalations via this bug from devices within your network as well, as they could become compromised at any moment via other means and then promote themselves to root.
Any wireless AP is going to run Linux because BSD has had a tough time with anything better than 802.11n
Any router/switch is going to be running an ancient Linux kernel, which isn't patched. EdgeOS for example, won't be patched. The old Brocade/Ruckus switches I got here, won't have this patched. I'm holding my breath for my Unifi APs.
i admit they don't enumerate their patches well, but the major residential router vendors do regular updates , usually indicated with "security fixes" .
unfortunately most lack SSH access or a real ability to test the kernel patch version.
MIPS and Arm have no security issues ever so never need patching which is an x86 only thing? Or maybe this comment is no more relevant than pointing out not all Arm patches apply to x86?
LLMs are giving script kids nation state level tools and expertise.
I'm on Comcast in USA, I BYOD for the router and it's a Netgear C3500 (I think). It gets new firmware pushed to it from Comcast. Can't even load your own manually.
> BYOD = bring your own device? And yet your isp pushes updates to it?
Perhaps better characterized as "buy your own device". Cable ISPs will only support a limited set of modems on their network, and they're fully managed by the ISP, both in terms of software and configuration.
Correct, and they are limited in features. I'm going to swap out this combo-modem+WiFi and get a dedicated -modem and then have a different device as my "edge" router/NAT
So comcast in the USA do it. Unclear how well. Assuming very well, what portion of the consumer market's home connections are covered? In the usa? In the world? This is the general issue beyond today's unpatched bug.
I've had probably at least about 5 routers supplied by 5 different ISPs over the past couple of decades and not one of them has ever got a security update. Is that an usual experience?
Every consumer router-wirelessAP I've seen runs linux.
I never see security upgrades for the kernels they use. Not one. Not ever.
Is this something that should be a cause for concern? Even if you don't run a consumer-grade tplink, netgear, asus, whatever router yourself.
Update: The context which I should have said is that I think LLMs are giving script kids nation state level tools and expertise. This known bug is always less interesting than the next twenty.