Psi9

which once again begs the question. why the fuck is your freezer connected to the internet

you do know you can just put a firewall rule in to prevent any IP options from hitting the server

The rule (matches header length > 20 bytes, i.e. IHL 6–15):

iptables -I INPUT 1 -m u32 --u32 "0>>24&0x0F=6:15" -m comment --comment ipopts-stopgap -j DROP

• ufw: add -A ufw-before-input -m u32 --u32 "0>>24&0x0F=6:15" -j DROP to /etc/ufw/before.rules, above the RELATED,ESTABLISHED accept line. Then run ufw reload.
• csf: put the iptables line in /usr/local/csf/bin/csfpre.sh so it survives csf restarts.
• Docker hosts: use -t raw -I PREROUTING instead, so container traffic is covered too.

Test: run ping -R at the box and watch the counter go up in iptables -L INPUT -v -n. Note that many networks drop option packets in transit, so test from the same LAN or a local netns.

its a stopgap. not a fix. but you don’t have to take all your servers offline … just put the block in and wait for the patch