Exploiting those vulnerabilities via pure network traffic is borderline impossible. Most CPU exploits (meltdown et al.) require execution on the device, you can’t do it via crafted network packets.
Solution: don’t run hosted services on your edge appliance.
In OP’s case, I’d use the RPi for the OpenWRT router and the miniPC for any relatively small hosted services I need. That way you can keep your services in its own DMZ away from your IOT devices assuming you have a smart tv/roku/firestick or other random likely vulnerable devices.
Network segment everything you can, but at the very least, I’d keep your services off of the device that is separating your LAN from WAN.
I can’t think of any typical services that you’d run on a router/home server that allow arbitrary code execution. The main risk was mostly web browsers with JavaScript, or VPS providers.
Either way, definitely unlikely for a home router.
I hear you, I host lots of stuff. But none I can think of would be RCE vulnerable directly from a CPU vulnerability. You could use a CPU vulnerability to privesc later, but once someone has RCE, your already pwn’d, and privesc is mostly a given anyway either way. So CPU vulnerabilities falls way down the list of things to worry about.
As long as you keep your router OS patched and up to date, CPU vulns really arent a concern.
deleted by creator
Exploiting those vulnerabilities via pure network traffic is borderline impossible. Most CPU exploits (meltdown et al.) require execution on the device, you can’t do it via crafted network packets.
deleted by creator
Solution: don’t run hosted services on your edge appliance.
In OP’s case, I’d use the RPi for the OpenWRT router and the miniPC for any relatively small hosted services I need. That way you can keep your services in its own DMZ away from your IOT devices assuming you have a smart tv/roku/firestick or other random likely vulnerable devices.
Network segment everything you can, but at the very least, I’d keep your services off of the device that is separating your LAN from WAN.
deleted by creator
I can’t think of any typical services that you’d run on a router/home server that allow arbitrary code execution. The main risk was mostly web browsers with JavaScript, or VPS providers.
Either way, definitely unlikely for a home router.
deleted by creator
I hear you, I host lots of stuff. But none I can think of would be RCE vulnerable directly from a CPU vulnerability. You could use a CPU vulnerability to privesc later, but once someone has RCE, your already pwn’d, and privesc is mostly a given anyway either way. So CPU vulnerabilities falls way down the list of things to worry about.
As long as you keep your router OS patched and up to date, CPU vulns really arent a concern.
deleted by creator