Metadata
- Source
- File: arXiv.org Snapshot; BRF by Hung et al (2023).pdf
- Zotero: View Item
- CiteKey: hungBRFEBPFRuntime2023
- Type: Preprint
- Title: BRF: eBPF Runtime Fuzzer,
- Author: Hung, Hsin-Wei; Sani, Ardalan Amiri;
- Year: 2023
Abstract
The eBPF technology in the Linux kernel has been widely adopted for different applications, such as networking, tracing, and security, thanks to the programmability it provides. By allowing user-supplied eBPF programs to be executed directly in the kernel, it greatly increases the flexibility and efficiency of deploying customized logic. However, eBPF also introduces a new and wide attack surface: malicious eBPF programs may try to exploit the vulnerabilities in the eBPF subsystem in the kernel. Fuzzing is a promising technique to find such vulnerabilities. Unfortunately, our experiments with the state-of-the-art kernel fuzzer, Syzkaller, shows that it cannot effectively fuzz the eBPF runtime, those components that are in charge of executing an eBPF program, for two reasons. First, the eBPF verifier (which is tasked with verifying the safety of eBPF programs) rejects many fuzzing inputs because (1) they do not comply with its required semantics or (2) they miss some dependencies, i.e., other syscalls that need to be issued before the program is loaded. Second, Syzkaller fails to attach and trigger the execution of eBPF programs most of the times. This paper introduces the BPF Runtime Fuzzer (BRF), a fuzzer that can satisfy the semantics and dependencies required by the verifier and the eBPF subsystem. Our experiments show, in 48-hour fuzzing sessions, BRF can successfully execute 8x more eBPF programs compared to Syzkaller. Moreover, eBPF programs generated by BRF are much more expressive than Syzkaller’s. As a result, BRF achieves 101% higher code coverage. Finally, BRF has so far managed to find 4 vulnerabilities (some of them have been assigned CVE numbers) in the eBPF runtime, proving its effectiveness.
Tags and Collections
- Keywords: 03 In Progress; BPF; Fuzzing; Linux Kernel
Comments
Annotations
Notes
Fuzzer that generates valid BPF programs (I’m assuming mainly helper function calls) and was able to find CVEs
- BRF parses kernel code to extract helper, constraint info (the error messages; the actual constraint is implemented manually), etc
- Adds helper function calls, branches, etc to satisfy the verifier
- Coordinates between map type, map attributes, and program type