A flaw was found in the Linux kernels eBPF implementation. By default, accessing the eBPF verifier is only accessible to privileged users with CAP_SYS_ADMIN. A local user with the ability to insert eBPF instructions can abuse a flaw in eBPF to corrupt memory. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Mitigation

This issue does not affect most systems by default. An administrator would need to have enabled the BPF JIT to be affected.

It can be disabled immediately with the command:

echo 0 > /proc/sys/net/core/bpf_jit_enable

Or it can be disabled for all subsequent boots of the system by setting a value in /etc/sysctl.d/44-bpf-jit-disable

start file

net.core.bpf_jit_enable=0

end file