Repository logo

Infoscience

  • English
  • French
Log In
Logo EPFL, École polytechnique fédérale de Lausanne

Infoscience

  • English
  • French
Log In
  1. Home
  2. Academic and Research Output
  3. Conferences, Workshops, Symposiums, and Seminars
  4. SoK: Challenges and Paths Toward Memory Safety for eBPF
 
conference paper

SoK: Challenges and Paths Toward Memory Safety for eBPF

Huang, Kaiming
•
Payer, Mathias  
•
Qian, Zhiyun
Show more
Blanton, Marina
•
Enck, William
Show more
2025
Proceedings - IEEE Symposium on Security and Privacy
46 IEEE Symposium on Security and Privacy

The extended Berkeley Packet Filter (eBPF) subsystem in Linux enables the extension of kernel functionality without modifying kernel code. In addition to its use in networking, eBPF provides the flexibility to perform tracing, add security checks, etc. To ensure that eBPF does not enable attackers to compromise the kernel, eBPF includes a verifier to validate every eBPF program before its execution, which includes checks that aim to prevent eBPF programs from modifying kernel memory due to memory errors. However, numerous vulnerabilities have been identified in the eBPF subsystem, including the verifier itself, which greatly violate expectations, leading to concerns about the threats of memory safety brought by eBPF. This paper presents the first systematic analysis of the memory safety risks inherent in the eBPF ecosystem, focusing on the challenges faced by the limitations of the eBPF verifier and current kernel defenses. We then evaluate proposed research mitigation strategies that apply isolation techniques, runtime checks, and static validation, highlighting their contributions and gaps. Our study finds that only 1.62-3.74% (37-85) of the memory operations in public eBPF programs cannot be proven memory safe comprehensively, motivating actionable insights towards enforcing comprehensive memory safety while accounting for performance and compatibility.

  • Details
  • Metrics
Type
conference paper
DOI
10.1109/SP61157.2025.00134
Scopus ID

2-s2.0-105009322728

Author(s)
Huang, Kaiming

Pennsylvania State University

Payer, Mathias  

École Polytechnique Fédérale de Lausanne

Qian, Zhiyun

University of California, Riverside

Sampson, Jack

Pennsylvania State University

Tan, Gang

Pennsylvania State University

Jaeger, Trent

University of California, Riverside

Editors
Blanton, Marina
•
Enck, William
•
Nita-Rotaru, Cristina
Date Issued

2025

Publisher

Institute of Electrical and Electronics Engineers Inc.

Published in
Proceedings - IEEE Symposium on Security and Privacy
ISBN of the book

9798331522360

Start page

848

End page

866

Subjects

ebpf

•

linux kernel

•

memory safety

•

program analysis

•

software security

•

system security

Editorial or Peer reviewed

REVIEWED

Written at

EPFL

EPFL units
HEXHIVE  
Event nameEvent acronymEvent placeEvent date
46 IEEE Symposium on Security and Privacy

San Francisco, United States

2025-05-12 - 2025-05-15

FunderFunding(s)Grant NumberGrant URL

European Union

European Research Council

NSF

CNS-1801534

Show more
Available on Infoscience
July 14, 2025
Use this identifier to reference this record
https://infoscience.epfl.ch/handle/20.500.14299/252263
Logo EPFL, École polytechnique fédérale de Lausanne
  • Contact
  • infoscience@epfl.ch

  • Follow us on Facebook
  • Follow us on Instagram
  • Follow us on LinkedIn
  • Follow us on X
  • Follow us on Youtube
AccessibilityLegal noticePrivacy policyCookie settingsEnd User AgreementGet helpFeedback

Infoscience is a service managed and provided by the Library and IT Services of EPFL. © EPFL, tous droits réservés