Alice in Kernel Land: Lessons Learned From the eBPF Rabbit Hole
summary
Automatic fuzzing targets the ebpf verifier and finds logic and branch-pruning bugs rather than just memory corruptions. A first prototype compiles verifier code to user space to avoid the global lock but yields <1% valid programs. A later framework (open source) generates 35k programs per minute, ran ~40 million inputs and finds CVE-2020-27194 and CVE-2023-2163 within a day by using verifier-log parsing and pointer-write detection strategies.
AI-written summary · about
chapters (11)
- 0:00eBPF introduction
- 1:49eBPF power and danger
- 6:05eBPF threat model
- 7:29eBPF verifier bugs
- 14:34Automate eBPF vulnerability discovery
- 17:45First eBPF fuzzer design
- 26:34Second fuzzer with Phosphorus
- 31:54Exploiting CVE-2023-2163
- 34:27Future of eBPF fuzzing
- 35:31Key takeaways
- 36:13Q&A
related talks
26mVerifying the Verifier eBPF Range Analysis Verification
43mHotBPF++: A More Powerful Memory Protection for the Linux Kernel
14mWill eBPF Save Us From the Next Global Outage?
30mTools for eBPF DevSecOps
43meBPF Superpowers for SRE
42mKernel Analysis Using eBPF
01h 18mTutorial: Getting Started with eBPF
52mStructure aware fuzzing