eBPF Verifier Bypass Fuzzer

Motivation

The eBPF verifier is the kernel’s gatekeeper, ensuring eBPF programs are safe before execution. Recent CVEs (like CVE-2023-39191) exposed that the verifier struggles to validate dynamic pointers (dynptrs). These bugs enable privilege escalation from CAP_BPF to full kernel-level code execution — a critical attack surface.

The verifier is complex (~20k lines of C), evolving rapidly with new features, and the newest implementations are the least battle-tested. Manual auditing can’t keep pace with the rate of change.

Proposal

A systematic fuzzing harness that targets bpf_dynptr structures and the verifier’s pointer validation paths to discover zero-day logic flaws.

Approach

1. Harness Construction — build a fuzzing harness specifically targeting bpf_dynptr structures and the verifier’s pointer validation paths
2. Verifier Bypass Attempts — generate eBPF programs that attempt to trick the verifier into accepting programs that access memory out of bounds
3. PoC Generation — for each bypass found, produce a Proof of Concept demonstrating privilege escalation from CAP_BPF to kernel-level code execution

Target Areas

• Dynamic pointer (bpf_dynptr) creation, slicing, and dereferencing
• Pointer arithmetic on dynptr-derived pointers
• Cross-map-type dynptr operations
• New eBPF standard library features where the verifier is least mature

Fuzzing Strategy

• Grammar-based fuzzing that generates syntactically valid but semantically adversarial eBPF programs
• Coverage-guided mutation to maximize verifier code path exploration
• Differential testing between verifier acceptance and actual runtime behavior

Alternatives Considered

• Syzkaller — general-purpose kernel fuzzer, not specialized for eBPF verifier semantics
• Manual auditing — effective but doesn’t scale with the rate of verifier changes
• Static analysis on verifier source — misses runtime state-dependent bugs

Decision

Pending — draft stage.