https://t.me/mtikpro/129
Исправления некоторых проблем уже доступны, но пока только в beta ветке:
MAJOR CHANGES IN v6.45:Переписка на форуме наводит меня на мысль о том, что автор не сдал проблемы корректно в MikroTik и решил попиариться:
----------------------
!) ipv6 - fixed soft lockup when forwarding IPv6 packets;
!) ipv6 - fixed soft lockup when processing large IPv6 Neighbor table;
----------------------
Changes in this release:
*) ipv6 - adjust IPv6 route cache max size based on total RAM memory;
normis (MikroTik Support)
Fri Mar 29, 2019 4:43 pm
He [автор планируемого доклада] did not send proof of concept for all issues, just a generic report about a crash. When he now said that CVE number such and such is not fixed, It was not clear, since we don't know what he will publish in that CVE. There is not a single issue, there are multiple issues, we fixed most, now he has stumbled upon another (memory leak in some other condition). We are fixing the others as well.В качестве временного фикса рекомендуется добавить аналогичные указанным ниже правила в IPv6 Firewall для защиты от утечек памяти:
/ipv6 firewall filterВместо 2001:db8:3::/64 необходимо указать ваш префикс
add action=drop chain=forward connection-mark=drop connection-state=new
/ipv6 firewall mangle
add action=accept chain=prerouting connection-state=new dst-address=2001:db8:3::/64 limit=2,5:packet
add action=mark-connection chain=prerouting connection-state=new dst-address=2001:db8:3::/64 new-connection-mark=drop passthrough=yes