Hacker News new | ask | show | jobs
by reduxredacted 5330 days ago
I've been tearing through this one and I have a very basic question:

Because it's in the IP stack, would a software firewall offer any sort of defense here?

1 comments

thinking about it, yes and no.

yes, because in windows traditionally third party firewalls are sandwiched between the tcp/ip stack and the network card driver. the firewall will see packets before the TCP/IP stack does and it can make a decision then.

but probably no, because since this is a refcounter bug there isn't anything specific about the packets that you are interested in blocking. you can probably try and apply some kind of ratelimiting action or something else, but what you're working around a failure in object life-cycle management on the part of the OS so you'll be guessing. it isn't like there's a "bad pattern" that you can match and drop to make everything OK.