CME-603
Unprivileged BPF Disabled
Description
Prevents unprivileged users from loading BPF programs into the kernel. BPF programs run in kernel context and vulnerabilities in the BPF verifier have been a frequent source of privilege escalation.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Privileges Required (PR) | L → H | Unprivileged user cannot load BPF programs to exploit verifier bugs |
CWE Relationships
Verification
Check unprivileged_bpf_disabled sysctl
$ cat /proc/sys/kernel/unprivileged_bpf_disabled
# Expected: 1
# Expected: 1
Platform: linux
Remediation
linux
Disable unprivileged BPF and harden BPF JIT via sysctl
sysctl -w kernel.unprivileged_bpf_disabled=1 net.core.bpf_jit_harden=2
printf 'kernel.unprivileged_bpf_disabled = 1\nnet.core.bpf_jit_harden = 2\n' > /etc/sysctl.d/99-cme-603-bpf-hardening.conf