Analysis of the security posture of eBPF
eBPF is a technology that enables sandboxed programs to be executed within a privileged context: the kernel of an operating system. It originated in the Linux kernel, and a large part of the kernel components can be instrumented with it. eBPF can be used to extend the functionality of the kernel without modifying the source code or loading kernel modules. In this way, eBPF adds programmability to the kernel and enables an efficient way of deploying applications within the Linux kernel.
Security risks and the role of the verifier
Security is an important consideration, as eBPF applications can run in a privileged context. To mitigate these risks, a verifier is used. Before eBPF instructions are loaded, the kernel verifier statically analyzes the code. Among other things, the verifier checks that the program cannot cause infinite loops, does not perform dangerous memory access, and that the complexity and code size remain within set limits. The implementation of this can be found in the kernel source code under kernel/bpf/verifier.c. After successful validation by the verifier, the code is considered safe to execute. eBPF programs can then access kernel-only functionalities, such as network traffic filtering, system call hooking, and tracing.
Use cases of eBPF
eBPF is widely used for building tooling in the areas of networking, monitoring, tracing, and packet filtering. In addition, eBPF can be used for hot patching, which allows bugs to be fixed immediately without disrupting other operational processes while applying a patch.
Risks and attack vectors
There are also clear risks. For example, eBPF applications have the ability to write to user-space memory. This can be exploited by malware to manipulate the memory of a process during system calls, which can provide rootkit-like capabilities to an attacker. In a broader sense, eBPF is an interesting attack vector because it can execute kernel programs without requiring the loading of a kernel module. This feature can be attractive to attackers who want to gain or abuse kernel-level access.
Research focus
This study conducted an in-depth analysis of eBPF with the aim of developing a holistic understanding of the technology, the associated risks, and the relevant attack surfaces.
