| + |
By default, except for linux-hardened, an unprivileged user can trigger an attack. For kernel that support to not allow unprivileged users to use performance events, this would require a privileged user with CAP_SYS_ADMIN, CAP_PERFMON or root to be able to abuse this flaw reducing its attack space. |
| + |
To confirm the current state, inspect the sysctl with the command: |
| + |
|
| + |
cat /proc/sys/kernel/perf_event_paranoid |
| + |
|
| + |
The setting >=3 would mean that unprivileged users can not use performance events, mitigating the flaw. |
| + |
A kernel update will be required to mitigate the flaw for root or users with CAP_SYS_ADMIN or CAP_PERFMON capabilities. |