Advancing Kernel Control Flow Integrity with eBPF
summary
Proposes an eBPF-based kCFI implementation that rewrites indirect-call no-ops into a trampoline which saves registers, packs caller/callee into the BPF context, and invokes synchronous eBPF policy programs; control-flow graph lives in eBPF maps and policy returns decide allow/kill. Prototype EKCFI trampoline matches LLVM-kCFI coverage, shows similar microbenchmark cost but is up to 3x slower on some lmbench tests; kprobe earlier incurred 26x kprobe overhead, fprobe cannot attach to ~10k of 59k functions and thus lacks coverage. Instrumenting every instruction can cost up to ~75% overhead.
AI-written summary · about
chapters (15)
- 0:00Introduction to talk
- 1:49Control Flow Integrity basics
- 3:16Limitations of static kernel CFI
- 4:43Why eBPF for kernel CFI
- 6:11Threat model and scope
- 7:39Kprobe overhead issues
- 9:26Fprobe approach and limits
- 13:45Comparison of kprobe and fprobe
- 14:28Need for new eBPF hooking
- 15:12EKCFI framework overview
- 17:43EKCFI performance evaluation
- 19:57Instrumentation overhead analysis
- 20:41Limitations of eBPF-based CFI
- 21:44Conclusion and future work
- 22:27Q&A session begins
related talks
27mFiner-grained kernel control flow integrity and challenges
33meBPF: exploring use case of BPF kernel infrastructure
47mUsing eBPF to Bring Kubernetes-Aware Security to the Linux Kernel
29meBPF on the Rise - Getting Started
29mBuzzing Across the Cloud Native Landscape with eBPF
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools
16mWhy Everyone Should Care About eBPF
44mLinux Kernel Control-Flow Integrity Sup...