Critical Linux CVE Puts Cardano Stake Pools on Alert

0:00 Okay guys, we've got another major security vulnerability that affects a lot of servers out there that use Linux. And because of this, it also affects the Cardano ecosystem because many of the nodes out there that run the state pools are running on this type of infrastructure. So let me go through the details here and what state pool operators need to do in regards to mitigate this risk.

0:22 Hi everyone. Welcome back. My name is Peter and I'll talk all things Crypto and Cardano. So let's get into the details of this particular vulnerability. So I woke up to this notice here, just in Cardano urges staple operators to patch the critical Linux kernel vulnerability CVE-202698432. And I had to dig into this one because I haven't heard much about this one, but it affects directly the Linux kernel dating back to version 4.4. So this is a vulnerability that's been around for quite a long time. and has been picked up by AI. And I believe Anthropix AI Labs found this vulnerability and worked a way to actually exploit the vulnerability. I'll go into the details about how this one actually works so that you have an

1:10 idea of what's actually going on. But we're seeing the notifications coming out, and generally the community is quite alarmed. And it's not just Kodano state port operators. This goes very deep. It is every Linux server out there. Anything that is connected to the internet, you can see a lot of the comments here. And we also had Mert from Solana Ecosystem point out just how bad this vulnerability is.

1:38 If you think it's bad, read it again. It is extremely bad. Then read it again and realize how bad this one is. So the details, you can get to it on the Red Hat website here, and you can see the vulnerability details, how it's described. So if you're technically minded and want to go into the details, links down below for you guys. But there are already patches for this. For the particular distributions here, we've got Debian, Red Hat, SUSE, Enterprise, Oracle, EK, and Amazon Linux kernels have all been patched. But the main one here, which a lot of people use is Ubuntu. And that one is the main concern because majority of users out there, Ubuntu has a very large footprint because it has the graphical interface and also the command line interface. It's fairly

2:28 easy to fire up and use and there's a lot of packages for it. So it's very popular. So that's the vulnerability that we're looking into at the moment. Now I do have some notes here in regards to how this vulnerability works. And I'll try and explain to you guys. So when two computers connect to each other through TCP, that particular connection type, they do a handshake. And during that handshake Linux keeps a small note of extra connection details.

2:53 And the bug is the timing mistake, which this one exploits. So one part of the kernel can throw that note away while the other part is still trying to read it. And this is basically like I'm in a shop or a restaurant. the slip is coming in for an order and the cook is still using it, but it gets binned.

3:12 So the cook suddenly doesn't know what's going on while it's trying to process that particular order. So an attacker can hit at that very moment by sending a carefully timed connection request with no password needed. And usually the machine just crashes. But in the worst case scenario, in some cases, which Anthropic managed to exploit, it could corrupt the memory and take control of it. So Atlas says, Anthropix Claude built a private proof of concept that gets the roots on servers with an MPTCP listener. An MPTCP is a variant of TCP. It couldn't verify those claims, but Atlas says the exploit is unpublished. So that's basically how it works, but let me explain it in terms of how it impacts. Kodano state pools out there. So

4:00 with Kodano nodes, there are two parts. There's the relay and then also the block producer. So this particular attack can attack the relays because they're exposed to the internet and could potentially crash them. So it will crash all the nodes, stop them from connecting with the rest of the Cardano network, and then hence that particular state pool won't be able to transmit its blocks to the rest of the network because the block producer needs to connect to its own relays. So if all those relays are down, you won't be able to transmit your blocks to the rest of the network and that particular state pool won't be producing blocks. but will be, but it won't be able to transmit them. So you won't have that connection

4:38 out there. Now in a worst case scenario, the hacker could gain control of the particular relay and find some data about the block producer because the relay has to connect to the block producer. It will know the IP address between the relay and the block producer. So it will know that relationship. Once that block producer IP address is exposed, it could potentially be attacked at that point.

5:02 open up various ports or whatever it needs, or relay its connection through the relay to the block producer, and then attack the block producer itself, crash the block producer, or in the worst case scenario, gain access to that. And then you'll be able to manipulate the block producer. Now, if you're a delegator, your ADA stays in your wallet.

5:20 It never goes to the stake pool. What an attacker could go after here is the pool's keys, potentially its pledged ADA and its ability to make blocks. That's the ramifications that could happen within a Kadano state pool. And this is probably very similar to how it could be exploited on the Ethereum ecosystem or even Solana or any other block producer node out there in the crypto space.

5:46 So yes, this is a very, very scary exploit. So far, I haven't seen any reports of an attack on a Kadano state pool. Now for Ubuntu users, there isn't that patch out yet. At the time of this recording, it's the 2nd of November. So there's no patch yet. So we're looking for that patch so we can patch the servers and ensure that this particular vulnerability isn't available anymore.

6:09 But there are workarounds at the moment to try and block that particular access type. So if you are in communication with your state pool operator, make sure that they've got some sort of patch, some sort of firewall block in place to stop this from happening. So talk to your state pool operator, ensure that your state pool is secure.

6:27 locked down and as secure as possible, wherever your ADA is being staked to. If you're a state pool operator, Intersect's weekly update says to check which kernel your block producer and relays are running, then apply the fixed kernel and reboot as soon as your distribution publishes it. The fix doesn't work until you reboot. Until then, you can turn off MPTCP if you don't use it and add a firewall rule that drops TCP packets carrying IPv4 options.

6:57 That only reduces your exposure. It doesn't fix the bug, so you still need to patch. So overall, guys, quite a scary exploit in general. Every week, there are more and more attacks, more and more exploits. So in terms of staple operator operations within the Kadana ecosystem, it's going to get a lot scarier, I think, with a lot more of these happening every single week. We may see various staples out there slowly closed down. And this is an unfortunate one here. The clay state pool here is coming to an end. And we've seen a lot of really good small state pool operators on the Kadana ecosystem shut its doors. And I believe this is because of the operating costs and the profitability of the actual state

7:46 pool itself, because it's just not viable anymore to run state pools with the low amount of ADA that's going through and the rewards that are being distributed from it. it doesn't match the operating costs. And because of that, small state pools tend to shut down. Now, this one here, you may argue that it's a fairly large small state pool and should be very profitable, but I don't think it is. So they've got roughly just under 8 million ADA staked to their pool from 5,500 or so delegates.

8:18 It's a fairly good pool, but it's just not enough to keep things going. It's just not enough to pay for operating costs. Clay's own post says the pool has been running at a loss for the past six months and their operator is moving on to new projects. Anyway, guys, check your ADA delegations, open up your Kadano wallet, see where your ADA is being delegated to, and just make sure that your state pool that you're delegating to is still in operations. Try and contact them, talk to them, and see if they've updated for this particular vulnerability as well. Anyway, guys, if you got something out of this video, make sure you hit that thumbs up, the like, subscribe, and notification bell.

8:56 You can support me down below with the YouTube memberships or the buy me a coffee there, or even delegate to my stake pool, Ada Oz. It's pretty close to max saturation at the moment, so I can only take small delegations, but every delegation helps decentralize the network that way with a small delegation, like split your wallets and delegate a little bit. It all helps. Stay positive, and I'll see you in the next video. Thank you.