EPF: Evil Packet Filter
summary
EPF demonstrates two concrete attacks, BPF-Reuse and BPF-ROP, that hijack kernel control flow and redirect execution into the BPF interpreter so unaligned or immediate-controlled instruction bytes (including embedded code pointers on 32-bit) execute and allow credential overwrite for privilege escalation on x8632/64. Defenses include instruction-set randomization (BPF-ISR), a BPF-NX range check, and BPF CFI to force entry-point checks; implemented defenses block EPF variants and cost roughly 0–3.2% throughput loss on common BPF-heavy workloads.
AI-written summary · about
chapters (9)
- 0:00EPF research introduction
- 1:09Kernel security basics
- 4:45What BPF is and how it works
- 7:16Attack assumptions
- 8:43BPF reuse attack
- 12:17BPF ROP on 32-bit
- 14:25Defenses against BPF attacks
- 16:35Attack and defense evaluation
- 19:30Conclusion and future work
related talks
57mBPF and Security. Friends and Foes
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
32meBPF: The Next Power Tool of SREs
43mHotBPF++: A More Powerful Memory Protection for the Linux Kernel
29meBPF on the Rise - Getting Started
01h 03mBPF and Spectre: Mitigating transient execution attacks
43meBPF Superpowers for SRE
40mThreat From The Inside: Investigate eBPF Malware