Analysis of the security posture of eBPF
eBPF is a technology that makes it possible to run sandboxed programs within a privileged context: the kernel of an operating system. It originated in the Linux kernel, and a large portion of the kernel’s components can be instrumented using it. eBPF can be used to extend the kernel’s functionality without modifying the source code or loading kernel modules. In this way, eBPF adds programmability to the kernel and enables an efficient method of application deployment within the Linux kernel.
Security risks and the role of the verifier
Security is a key concern, as eBPF applications can run in a privileged context. To mitigate these risks, a verifier is used. Before eBPF instructions are loaded, the kernel verifier performs a static analysis of the code. Among other things, the verifier checks whether the program can cause infinite loops, whether it performs any dangerous memory accesses, and whether the complexity and code size remain within established limits. The implementation of this can be found in the kernel source code under kernel/bpf/verifier.c. After successful validation by the verifier, the code is considered safe to execute. eBPF programs can then access kernel-only features, such as network traffic filtering, system call hooking, and tracing.
Use cases of eBPF
eBPF is widely used for building tooling in the areas of networking, monitoring, tracing, and packet filtering. In addition, eBPF can be used for hot patching, which allows bugs to be fixed immediately without disrupting other operational processes while applying a patch.
Risks and attack vectors
There are also clear risks. For example, eBPF applications have the ability to write to user-space memory. Malware can exploit this to manipulate a process’s memory during system calls, which can provide an attacker with rootkit-like capabilities. More broadly, eBPF represents an interesting attack vector because it can execute kernel programs without requiring the loading of a kernel module. This feature may be attractive to attackers seeking to gain or exploit kernel-level access.
Research focus
This study conducted an in-depth analysis of eBPF with the aim of developing a holistic understanding of the technology, the associated risks, and the relevant attack surfaces.
