Verifying the Verifier: eBPF Range Analysis Verification-Reference-Cited by-同舟云学术

Verifying the Verifier: eBPF Range Analysis Verification

Published:2023 Issue: Volume: Page:226-251
ISSN:0302-9743
Container-title:Computer Aided Verification
language:
Short-container-title:

Author:

Vishwanathan Harishankar,Shachnai Matan,Narayana Srinivas,Nagarakatte Santosh

Abstract

AbstractThis paper proposes an automated method to check the correctness of range analysis used in the Linux kernel ’s eBPF verifier. We provide the specification of soundness for range analysis performed by the eBPF verifier. We automatically generate verification conditions that encode the operation of the eBPF verifier directly from the Linux kernel ’s C source code and check it against our specification. When we discover instances where the eBPF verifier is unsound, we propose a method to generate an eBPF program that demonstrates the mismatch between the abstract and the concrete semantics. Our prototype automatically checks the soundness of 16 versions of the eBPF verifier in the Linux kernel versions ranging from 4.14 to 5.19. In this process, we have discovered new bugs in older versions and proved the soundness of range analysis in the latest version of the Linux kernel.

Publisher

Springer Nature Switzerland

Link

https://link.springer.com/content/pdf/10.1007/978-3-031-37709-9_12

Reference74 articles.

1. bpf: fix incorrect sign extension in check_alu_op(). Accessed 14 Jan 2020. https://github.com/torvalds/linux/commit/95a762e2c8c942780948091f8f2a4f32fce1ac6f

2. bpf, x32: Fix bug with ALU64 LSH, RSH, ARSH BPF_X shift by 0. Accessed 14 Apr 2021. https://github.com/torvalds/linux/commit/68a8357ec15bdce55266e9fba8b8b3b8143fa7d2

3. CVE-2017-16996 Mishandling of register truncation. Accessed 22 Jan 2023. https://nvd.nist.gov/vuln/detail/CVE-2017-16996

4. CVE-2017-17852 Mishandling of 32-bit ALU ops. Accessed 22 Jan 2023. https://nvd.nist.gov/vuln/detail/CVE-2017-17852

5. CVE-2017-17853 Mishandling of 32-bit ALU ops. Accessed 22 Jan 2023. https://nvd.nist.gov/vuln/detail/CVE-2017-17853

Cited by 7 articles. 订阅此论文施引文献订阅此论文施引文献，注册后可以免费订阅5篇论文的施引文献，订阅后可以查看论文全部施引文献

1. Towards Functional Verification of eBPF Programs;Proceedings of the SIGCOMM Workshop on eBPF and Kernel Extensions;2024-08-04

2. An Empirical Study on the Challenges of eBPF Application Development;Proceedings of the SIGCOMM Workshop on eBPF and Kernel Extensions;2024-08-04

3. NetEdit: An Orchestration Platform for eBPF Network Functions at Scale;Proceedings of the ACM SIGCOMM 2024 Conference;2024-08-04

4. Research Report: Enhanced eBPF Verification and eBPF-based Runtime Safety Protection;2024 IEEE Security and Privacy Workshops (SPW);2024-05-23

5. Merlin: Multi-tier Optimization of eBPF Code for Performance and Compactness;Proceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 3;2024-04-27