Return to Sender - Detecting Kernel Exploits with eBPF

## Overview

In this talk, Guillaume Fournier, a security engineer on the Cloud Workload Security (CWS) team at Datadog, addresses the challenges of detecting and preventing Linux kernel exploits at runtime using extended Berkeley Packet Filter (eBPF). In production environments, critical CVEs are continuously discovered in the Linux kernel (such as Dirty Pipe), but patching and upgrading kernel versions across an entire fleet can take weeks or months. Consequently, security teams require interim solutions to monitor and protect vulnerable hosts while deferring kernel upgrades. To address this problem space, the speaker introduces **CRY**, an open-source project designed to detect and mitigate kernel exploits.

---

## Targeted Threat Models

While there are numerous attack vectors against the Linux kernel, the presented effort targets three primary vulnerability and exploitation categories:

1. **Execution Flow Redirection:** Exploits where an adversary attempts to alter or redirect the normal execution flow within the kernel. 2. **Logic Bugs:** Flaws where an attacker performs unauthorized actions because improper access control checks were missed or bypassed due to programming errors, leading the kernel to permit prohibited operations. 3. **Post-Compromise Runtime Alterations:** Post-exploitation behavior where an attacker alters kernel structures or state to hide tracks and facilitate further compromise of hosted services.

The speaker emphasizes establishing realistic expectations: catching every single exploit across these broad categories is unfeasible. Instead, the pragmatic goal of using eBPF is to disrupt exploit stability and "make attackers' lives a living hell."

---

## eBPF Mechanics and Suitability

### How eBPF Works - eBPF allows developers to compile C programs into bytecode and load them into the Linux kernel using the `bpf()` system call. - A kernel verifier performs safety and stability checks to prevent kernel panics or crashes. - Verified programs attach to specific hook points (such as kprobes, tracepoints, or LSM hooks) across various program types to trigger execution on specific kernel events.

### Advantages of eBPF for Exploit Detection - **Broad Kernel Support:** By avoiding bleeding-edge helper features, eBPF programs and detections can be backported to run on kernels as old as version 4.1. - **Safety and Stability:** Unlike traditional kernel modules (LKMs), eBPF provides built-in verifier guarantees against kernel panics. - **Deep Visibility & Enforcement:** Provides a rich feature set to observe kernel-space behavior, along with write access and active enforcement primitives available on sufficiently recent kernels.

---

## The CRY Tool and Deployment Considerations

The speaker introduces **CRY** as an open-source tool built to realize eBPF-based kernel threat detection. Deploying runtime kernel monitoring tools like CRY requires balancing security coverage against performance:

- **Feature Capabilities:** CRY implements detection mechanisms targeting the defined threat models. - **Performance Overhead:** In real-world enterprise environments, evaluating CPU and latency overhead is critical before rolling out eBPF-driven exploit detection across host fleets.