kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs
undesirable out-of-bounds speculation on pointer arithmetic in various
cases, including cases of different branches with different state or limits
to sanitize, leading to side-channel attacks.

Jann Horn discovered that the eBPF implementation in the Linux kernel was
insufficiently hardened against Spectre V1 attacks. A local attacker could
use this to expose sensitive information.

tyhicks

Mitigation for this vulnerability is available by setting the kernel.unprivileged_bpf_disabled sysctl to 1: $ sudo sysctl kernel.unprivileged_bpf_disabled=1 $ echo kernel.unprivileged_bpf_disabled=1 | \ sudo tee /etc/sysctl.d/90-CVE-2019-7308.conf This issue is mitigated on systems that use secure boot, thanks to the kernel lockdown feature which blocks BPF program loading.