This describes a Linux kernel vulnerability in IPv4 checksum handling where malformed checksum metadata can reach the ipv4 stack and cause skb_checksum_help to corrupt the network header. The corruption can lead to unpredictable behavior and has been independently reproduced; it was reported by a researcher named Paulos. The kernel change adds validation of checksum_start before completing the checksum as a defense-in-depth measure, with a note that a more complete input validation at packet ingress is planned but requires more work.
Ubuntu assigns a CVSS v3 score of 9.3 (critical) for the issue while marking overall Ubuntu priority as MEDIUM. The notice lists many kernel packages and flavors across supported releases (LTS and HWE variants, AWS/Azure/AWS-HWE, KVM, Azure, etc.) and shows most entries as “Needs evaluation,” indicating patches are still being assessed or staged for different images. Administrators should track updates for their specific kernel flavor; the immediate mitigation is the added checksum_start validation, and a fuller fix at input validation will follow.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Neuralwatt emphasizes that prompt caching significantly impacts energy efficiency in AI models, with cache misses roughly doubling energy use. Proper harness design can reduce unnecessary recomputation, saving both energy and computational costs. (neuralwatt.com)
An integration in Home Assistant scans secrets without user authorization, causing privacy concerns. The user warns that this mechanism could be abused, despite no consent given. (github.com)
Cloudera has been ordered to pay back wages and faces a two-year debarment for discriminating against US workers. The settlement was secured by the U.S. Department of Justice and the Department of Labor. (justice.gov)
911 emergency response system in the US struggles to effectively address mental health crises and properly route emergency calls. This highlights the need for specialized response protocols to improve outcomes. (themarshallproject.org)
The seeds for the NIST elliptic curves were generated using the drand48 random number generator seeded with the current UNIX timestamp in 1997-98. A team from Anthropic discovered and claimed the bounty by revealing this cryptographic history, donating the prize to Let’s Encrypt. (words.filippo.io)
Claude revealed that the seeds for the widely used ECDSA elliptic curve standards were generated using a Unix time seed in the C library's random-number generator, not by hashing humorous phrases as previously thought. This discovery clarifies the long-standing mystery about the origins of these cryptographic parameters. (anthropic.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.