| + |
The default kernels prevent unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space. |
| + |
To confirm the current state, inspect the sysctl with the command: |
| + |
|
| + |
cat /proc/sys/kernel/unprivileged_bpf_disabled |
| + |
|
| + |
The setting >=1 would mean that unprivileged users can not use eBPF, mitigating the flaw. |
| + |
A kernel update will be required to mitigate the flaw for root or users with CAP_SYS_ADMIN capabilities. |