BRF: eBPF Runtime Fuzzer
Hsin-Wei Hung, Ardalan Amiri Sani

TL;DR
BRF is a new fuzzer designed specifically for the eBPF runtime in Linux, significantly improving fuzzing effectiveness, code coverage, and vulnerability discovery compared to existing tools like Syzkaller.
Contribution
This paper introduces BRF, a specialized eBPF runtime fuzzer that overcomes limitations of prior fuzzers by satisfying verifier semantics and dependencies, leading to better coverage and vulnerability detection.
Findings
BRF executes 8x more eBPF programs than Syzkaller in 48 hours.
BRF achieves 101% higher code coverage than Syzkaller.
BRF discovered 4 vulnerabilities in the eBPF runtime, some with CVE assignments.
Abstract
The eBPF technology in the Linux kernel has been widely adopted for different applications, such as networking, tracing, and security, thanks to the programmability it provides. By allowing user-supplied eBPF programs to be executed directly in the kernel, it greatly increases the flexibility and efficiency of deploying customized logic. However, eBPF also introduces a new and wide attack surface: malicious eBPF programs may try to exploit the vulnerabilities in the eBPF subsystem in the kernel. Fuzzing is a promising technique to find such vulnerabilities. Unfortunately, our experiments with the state-of-the-art kernel fuzzer, Syzkaller, shows that it cannot effectively fuzz the eBPF runtime, those components that are in charge of executing an eBPF program, for two reasons. First, the eBPF verifier (which is tasked with verifying the safety of eBPF programs) rejects many fuzzing…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSecurity and Verification in Computing · Advanced Malware Detection Techniques · Software Testing and Debugging Techniques
