Scholarlink

<p>The extended Berkeley Packet Filter (eBPF) has been widely used and is regarded as a secure alternative to kernel modules for extending kernel functionality. As an emerging kernel subsystem, it is expected to remain resilient against exploitation through existing kernel vulnerabilities. Unfortunately, the exploitability of eBPF has not been thoroughly studied. In this paper, we systematically investigate the security of eBPF and identify two new risks: the absence of hijacking defenses in the eBPF interpreter and incomplete Control Flow Integrity (CFI) enforcement in the Just-In-Time (JIT) compiler. To demonstrate practical impact, we introduce Flow Hijacking, a generic eBPF exploitation technique that bypasses kernel code and CFI protections to hijack the eBPF execution. We propose two key techniques: Tailcall Trampoline, which corrupts tailcalls to redirect the interpreter to injected code without modifying function pointers, and JIT-Type Confusion, which forges trusted pointers in JITed code to gain arbitrary kernel memory access. We further formulate CVE requirements, evaluate Flow Hijacking against 16 real-world CVEs from different kernel subsystems, and show that it consistently amplifies their capabilities to bypass kernel protections. Additionally, we present a formal proof showing that Flow Hijacking achieves Turing completeness when targeting the interpreter. Finally, we develop a lightweight runtime validation mechanism that effectively mitigates Flow Hijacking with less than 1% performance overhead. We are communicating with the Linux community to address the identified issues.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Flow Hijacking in eBPF: Exploitation and Mitigation Across both Interpreter and JIT Execution

  • 期刊论文

  • 发表日期：

    2025年9月9日

查看全文
  • Yifei Wu,
  • Qirui Liu,
  • Wenbo Shen,
  • Zhuoruo Zhang,
  • Jiayi Hu,
  • Rui Chang

摘要

The extended Berkeley Packet Filter (eBPF) has been widely used and is regarded as a secure alternative to kernel modules for extending kernel functionality. As an emerging kernel subsystem, it is expected to remain resilient against exploitation through existing kernel vulnerabilities. Unfortunately, the exploitability of eBPF has not been thoroughly studied. In this paper, we systematically investigate the security of eBPF and identify two new risks: the absence of hijacking defenses in the eBPF interpreter and incomplete Control Flow Integrity (CFI) enforcement in the Just-In-Time (JIT) compiler. To demonstrate practical impact, we introduce Flow Hijacking, a generic eBPF exploitation technique that bypasses kernel code and CFI protections to hijack the eBPF execution. We propose two key techniques: Tailcall Trampoline, which corrupts tailcalls to redirect the interpreter to injected code without modifying function pointers, and JIT-Type Confusion, which forges trusted pointers in JITed code to gain arbitrary kernel memory access. We further formulate CVE requirements, evaluate Flow Hijacking against 16 real-world CVEs from different kernel subsystems, and show that it consistently amplifies their capabilities to bypass kernel protections. Additionally, we present a formal proof showing that Flow Hijacking achieves Turing completeness when targeting the interpreter. Finally, we develop a lightweight runtime validation mechanism that effectively mitigates Flow Hijacking with less than 1% performance overhead. We are communicating with the Linux community to address the identified issues.