HotBPF++: A More Powerful Memory Protection for the Linux Kernel
summary
HotBPF++ automatically generates and installs eBPF programs from syzkaller/kernel sanitizer reports to stop vulnerabilities from being triggered rather than patching them, targeting five bug classes (heap/slab OOB, stack/global OOB, use‑after‑free, integer overflow, uninitialized memory). It uses the eBPF verifier/JIT plus a new helper to set return registers, synthesizes native-address checks, and implements a checkpoint-and-restore to skip faulty functions and return errors. Evaluation shows negligible average overhead (about -3% to +4%) though some high-concurrency hooks hit 20–30%, and UAF uses a sweeper optimization 256MB/4s; demos block real CVEs on 5.15.
AI-written summary · about
chapters (21)
- 0:00HotBPF++ introduction
- 1:45Preventing kernel vulnerabilities
- 3:52BPF programs from Syzkaller
- 5:40Workflow from report to prevention
- 7:03Heap slab out-of-bounds case
- 8:33Demo preventing kernel exploit
- 11:49Advantages over traditional methods
- 14:36HotBPF++ architecture
- 15:39Error-independent mechanisms
- 17:51Source-to-binary mapping
- 18:12Checkpoint and restore
- 21:02Error-dependent policies
- 23:14Extending to new vulnerabilities
- 24:40Use-after-free prevention
- 26:05Performance overhead
- 28:34Scalability with BPF programs
- 29:56Optimizing sweeper parameters
- 31:03Summary and future work
- 36:04Q&A: State during recovery
- 37:50Q&A: Testing new crashes
- 39:00Q&A: Alternative runtime approaches
related talks
27mHotBPF - An On-demand and On-the-fly Memory Protection for the Linux Ker...
29meBPF on the Rise - Getting Started
01h 03mBPF and Spectre: Mitigating transient execution attacks
34mWhat's new in the BPF world?
32meBPF: BPF kernel infrastructure
33meBPF: exploring use case of BPF kernel infrastructure
42mResolving Performance and Security Issues with eBPF
14mWill eBPF Save Us From the Next Global Outage?