Just to clarify what this is probably about, for people who don't do security research (that's what Quarkslab does) --- this is mostly valuable information for people who need to instrument apps under test to see what they're doing.
Locked-down TLS is a pain for testers, because, of course, the whole idea is preventing third parties from seeing plaintext. But that's what app testers need to do (usually, to get enough information to write their own tooling-grade clients and servers to use to probe vulnerabilities with). There's a bunch of different tools people use for this purpose; Frida is probably the best-known example, for mobile and native clients.
But if your target under test is Linux, modern eBPF gives you enough tooling to capture plaintext without directly instrumenting binaries, which is handy.
This isn't, like, per se a vulnerability; they're not saying it is.
Locked-down TLS is a pain for testers, because, of course, the whole idea is preventing third parties from seeing plaintext. But that's what app testers need to do (usually, to get enough information to write their own tooling-grade clients and servers to use to probe vulnerabilities with). There's a bunch of different tools people use for this purpose; Frida is probably the best-known example, for mobile and native clients.
But if your target under test is Linux, modern eBPF gives you enough tooling to capture plaintext without directly instrumenting binaries, which is handy.
This isn't, like, per se a vulnerability; they're not saying it is.