BRF: eBPF Runtime Fuzzer

TL;DR

BRF is a new fuzzer designed specifically for the eBPF runtime in Linux, significantly improving fuzzing effectiveness, code coverage, and vulnerability discovery compared to existing tools like Syzkaller.

Contribution

This paper introduces BRF, a specialized eBPF runtime fuzzer that overcomes limitations of prior fuzzers by satisfying verifier semantics and dependencies, leading to better coverage and vulnerability detection.

Findings

BRF executes 8x more eBPF programs than Syzkaller in 48 hours.

BRF achieves 101% higher code coverage than Syzkaller.

BRF discovered 4 vulnerabilities in the eBPF runtime, some with CVE assignments.

Abstract

The eBPF technology in the Linux kernel has been widely adopted for different applications, such as networking, tracing, and security, thanks to the programmability it provides. By allowing user-supplied eBPF programs to be executed directly in the kernel, it greatly increases the flexibility and efficiency of deploying customized logic. However, eBPF also introduces a new and wide attack surface: malicious eBPF programs may try to exploit the vulnerabilities in the eBPF subsystem in the kernel. Fuzzing is a promising technique to find such vulnerabilities. Unfortunately, our experiments with the state-of-the-art kernel fuzzer, Syzkaller, shows that it cannot effectively fuzz the eBPF runtime, those components that are in charge of executing an eBPF program, for two reasons. First, the eBPF verifier (which is tasked with verifying the safety of eBPF programs) rejects many fuzzing inputs because (1) they do not comply with its required semantics or (2) they miss some dependencies, i.e., other syscalls that need to be issued before the program is loaded. Second, Syzkaller fails to attach and trigger the execution of eBPF programs most of the times. This paper introduces the BPF Runtime Fuzzer (BRF), a fuzzer that can satisfy the semantics and dependencies required by the verifier and the eBPF subsystem. Our experiments show, in 48-hour fuzzing sessions, BRF can successfully execute 8x more eBPF programs compared to Syzkaller. Moreover, eBPF programs generated by BRF are much more expressive than Syzkaller's. As a result, BRF achieves 101% higher code coverage. Finally, BRF has so far managed to find 4 vulnerabilities (some of them have been assigned CVE numbers) in the eBPF runtime, proving its effectiveness.