Finding and Exploiting Kernel Vulnerabilities in the eBPF Subsystem
Examines vulnerability patterns in the Linux eBPF verifier and JIT compiler, demonstrating root privilege escalation via memory corruption.
Summary
The eBPF Subsystem and In-Kernel Verification
Extended Berkeley Packet Filter (eBPF) allows unprivileged and privileged user-space programs to execute sandboxed code inside the Linux kernel, relying on a complex in-kernel static verifier for memory safety.
Flaws in eBPF Verifier Range Tracking and ALU Logic
Agostino Panico analyzes subtle arithmetic logic errors, bounds-tracking mistakes, and 32-bit vs. 64-bit sign extension bugs within the eBPF verifier engine.
Bypassing Kernel Mitigations to Gain Root
By tricking the verifier into calculating incorrect register bounds, an attacker can construct out-of-bounds read/write primitives in kernel memory, defeating KASLR and escalating to full root privileges.
Hardening eBPF and Kernel Verifier Defenses
Securing the eBPF subsystem requires restricting unprivileged eBPF execution via sysctl, deploying automated kernel fuzzing, and integrating formal verification into verifier rule sets.
Related talks
Main Stage·47 min
Jeff Dileo
Demonstrates how eBPF programs can be weaponized to create undetectable Linux kernel rootkits with full privilege and persistent covert channels.
Main Stage·50 min
Plet
Plet details plet: Stealing Identity Management Systems Novell's Identity Manager and related components are become fairly common in large networks.
Main Stage·35 min
Luke Jennings
Luke Jennings details luke Jennings:One Token to Rule Them All: Post-Exploitation Fun in Windows Environments The defense techniques employed by large software manufacturers are getting better.