On Fri, Jan 5, 2018 at 8:39 AM, Nikos Chantziaras <rea...@gmail.com> wrote:
> On 04/01/18 18:18, Rich Freeman wrote: > >> For variant 1 the only known vulnerability is BPF which probably >> next to nobody uses >> > > I had to enable various BPF settings in the kernel because systemd > wouldn't shut up about it. It prints warning messages during boot that the > system doesn't support BPF. After enabling it, systemd was happy and > stopped barking at me. > > The vulnerability specifically mentions EBPF and JIT so I'd say its CONFIG_HAVE_EBPF_JIT, but there's also CONFIG_BPF_JIT. I notice EBPF_JIT is =y in my .config, grepping the sysctl -a output for bpf only returns; kernel.unprivileged_bpf_disabled = 0 And https://github.com/linuxkit/linuxkit/commit/720fb219cea1fea99c2bba1d01f771eb43b2000b "On 4.9.x and 4.14.x kernels ebpf verifier bugs allow ebpf programs to access (read/write) random memory. Setting kernel.unprivileged_bpf_disabled=1 mitigates this somewhat until it is fixed upstream."
