A protection method against malicious eBPF bytecode
By setting checkpoints in the eBPF interpreter to verify the legitimacy of eBPF programs, identifying and blocking the execution of malicious eBPF bytecode, the problem of existing technologies being unable to resist eBPF interpreter stream hijacking attacks is solved, achieving efficient kernel protection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- ZJU HANGZHOU GLOBAL SCI & TECH INNOVATION CENT
- Filing Date
- 2023-12-26
- Publication Date
- 2026-07-31
AI Technical Summary
Existing kernel protection mechanisms are ineffective against eBPF interpreter flow hijacking attacks. Attackers can bypass read-only protection and control flow integrity protection, and use the powerful expressive capabilities of eBPF to launch attacks, threatening the security of the operating system.
By tracing the program counter data stream of the eBPF interpreter, target objects that are vulnerable to tampering by malicious eBPF bytecode are identified. Checkpoints are set in the Linux kernel to verify the legitimacy of eBPF programs. The corresponding legitimate pointers are searched from the legitimate set using the ID of the eBPF program structure, thereby dynamically preventing the execution of malicious bytecode.
It effectively resists eBPF interpreter stream hijacking attacks, has low performance overhead, avoids redundant checks, improves protection efficiency, and ensures the security of the eBPF subsystem.
Smart Images
Figure CN117932602B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of operating system kernel protection, specifically relating to a method for protecting against malicious eBPF bytecode. Background Technology
[0002] Operating system security, especially the security of the Linux kernel, is crucial for ensuring the stability of computer systems and the confidentiality of user data. As the core of an open-source system, the security of the Linux kernel directly impacts the information security of millions of users and businesses, and is fundamental to maintaining the stability and availability of computing environments. However, precisely because of its widespread use and open-source code, the Linux kernel has always been a prime target for hackers and malware attacks; therefore, ensuring the security of the Linux kernel is of paramount importance.
[0003] eBPF (extended Berkeley Packet Filter) is a novel technology for loading and executing user-supplied programs (eBPF programs) within the Linux kernel. Its development has been rapid, and it has become an important component of the kernel. Compared to traditional loadable kernel module schemes, eBPF employs a verifier to ensure the security of eBPF programs. This security guarantee makes eBPF a promising technology that may become a practical way to extend kernel functionality. Today, eBPF is widely used in various fields such as system observation, security, and networking.
[0004] However, as a promising Linux subsystem, eBPF's mechanism of allowing users to inject kernel bytecode introduces inherent risks beyond kernel vulnerabilities (such as validator errors). Attackers can hijack the interpreted stream of bytecode to gain the ability to execute arbitrary bytecode (hereinafter referred to as eBPF interpreter stream hijacking attack), posing a new challenge to kernel protection. It is well known that kernel vulnerabilities are difficult to avoid due to the large codebase and complex functions of the Linux kernel. Unfortunately, current research on eBPF security mainly focuses on validator improvements, neglecting the potential threats that the eBPF subsystem itself may introduce. By implementing eBPF interpreter stream hijacking attacks, many seemingly low-risk vulnerabilities can be exploited to attack the operating system kernel, posing a significant threat to the security of the entire computer system.
[0005] Existing kernel protection mechanisms are unable to defend against eBPF interpreted flow hijacking attacks, which can bypass read-only protection without modifying page tables, and simultaneously bypass data non-executability protection and control flow integrity protection. Furthermore, the attack's powerful expressive capabilities (Turing completeness) allow attackers to counter many advanced protection measures such as SELinux, further increasing the threat of eBPF interpreted flow hijacking attacks.
[0006] Therefore, there is a need to provide a protection method that can make up for the lack of existing kernel protection and effectively resist the threat of eBPF interpreter stream hijacking attacks with low performance overhead. Summary of the Invention
[0007] This invention provides a protection method against malicious eBPF bytecode, which can effectively resist the threat of eBPF interpreter stream hijacking attacks with low performance overhead.
[0008] This invention provides a method for protecting against malicious eBPF bytecode, comprising:
[0009] (1) Trace the program counter data stream of the eBPF interpreter and identify data that is directly or indirectly related to the program counter data stream as target objects that are easily tampered with by malicious eBPF bytecode.
[0010] (2) Locate functions in the Linux kernel that use the target object, and set checkpoints at the entry points of the functions to verify the legitimacy of the eBPF program;
[0011] Verify the legitimacy of the eBPF procedure at the set checkpoints, including:
[0012] Move the pointer of the eBPF program structure to be inspected corresponding to the target object according to the offset of the target object to access the fields in the target object, and add the offset of the field to the pointer corresponding to the field to obtain the id of the eBPF program structure;
[0013] Based on the ID of the eBPF program structure, the corresponding valid eBPF program structure pointer is searched from the set of valid eBPF program structure pointers. If the eBPF program structure pointer to be checked matches the value of the corresponding valid eBPF program structure pointer, then the eBPF program is valid.
[0014] Furthermore, data identified as directly or indirectly related to the program counter data stream is considered as target objects susceptible to malicious eBPF bytecode tampering, wherein:
[0015] The directly related data refers to the data that is directly manipulated by the pointer of the program counter data stream;
[0016] The indirectly related data is data that is indirectly operated on by recursively searching for pointers to the program counter data stream.
[0017] Furthermore, before tracing the program counter data stream of the eBPF interpreter, the obtained eBPF interpreter stream data is filtered to remove data marked as read-only.
[0018] Furthermore, the system searches for functions in the Linux kernel that use the target object, specifically interpreter functions.
[0019] Furthermore, checkpoints can be set at the end of the function's call processing branch to verify the legitimacy of the eBPF program.
[0020] Furthermore, before accessing the id of the eBPF program structure pointer to be checked through the pointer corresponding to the field, the field is checked by a memory access security check function.
[0021] Furthermore, by utilizing the Linux kernel's identifier reverse mapping structure and retrieval interface, the corresponding valid eBPF program structure pointer is searched from the set of valid eBPF program structure pointers based on the eBPF program structure pointer to be checked.
[0022] Furthermore, in cases where the eBPF program pointer cannot be directly obtained, this invention indirectly infers the address of the object through the bytecode field within the eBPF program object.
[0023] Compared with the prior art, the beneficial effects of the present invention are as follows:
[0024] This invention overcomes the shortcomings of existing technologies in resisting eBPF interpreter stream hijacking attacks. By identifying target objects vulnerable to malicious eBPF bytecode tampering, this invention can find necessary checkpoints based on the identified target objects, avoiding redundant checks and improving protection efficiency. Furthermore, this invention can search for corresponding legitimate eBPF program structure pointers from the eBPF program structure pointer set (identifier reverse mapping) based on the obtained eBPF program structure ID, without having to compare the eBPF program structure pointer to be checked one by one with the eBPF program structure pointer set. This effectively resists the threat of eBPF interpreter stream hijacking attacks while maintaining low performance overhead. Attached Figure Description
[0025] Figure 1 A flowchart illustrating a method for protecting against malicious eBPF bytecode, provided for a specific embodiment of the present invention;
[0026] Figure 2 A flowchart illustrating the verification of the legitimacy of the eBPF program at a set checkpoint, provided as a specific embodiment of the present invention. Detailed Implementation
[0027] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings. It should be noted that the embodiments described below are intended to facilitate the understanding of the present invention and do not limit it in any way.
[0028] Faced with the inability of kernel protection mechanisms to defend against eBPF interpreter stream hijacking attacks, this invention, in its specific embodiments, identifies target objects vulnerable to malicious eBPF bytecode tampering from the program counter data stream of the eBPF interpreter. Based on these target objects, it sets checkpoints in the Linux kernel to defend against malicious eBPF bytecode attacks. During the inspection process, it obtains a corresponding valid eBPF program structure pointer based on the eBPF program structure ID. This pointer is compared with the pointer of the eBPF program structure to be inspected, thus achieving defense with low performance overhead. Specifically, this invention provides a method for protecting against malicious eBPF bytecode, such as... Figure 1 As shown, it includes:
[0029] (1) Trace the program counter data stream of the eBPF interpreter and identify data that is directly or indirectly related to the program counter data stream as target objects that are easily tampered with by malicious eBPF bytecode. Since the eBPF program cannot be used directly, the eBPF program is simulated by the eBPF interpreter. The program counter data stream is obtained during the simulation process. The process of tracing the program counter data stream is equivalent to tracing the interpretation stream of the eBPF program. The target objects of the eBPF program that are easily tampered with by malicious eBPF bytecode can be found relatively easily by manual means or by algorithms.
[0030] (2) Locate the function in the Linux kernel that uses the target object obtained in step (1), and set a checkpoint at the entry point of the function to verify the legitimacy of the eBPF program. Based on the target object obtained in the previous step, find the function that uses the target object in the eBPF interpreter in the Linux kernel, and set a checkpoint at the entry point of the function to check its security before the Linux kernel executes the eBPF program, thereby achieving the protection effect.
[0031] The specific embodiments of the present invention provide for verifying the legitimacy of an eBPF program at designated checkpoints, including:
[0032] (2.1) Obtain the eBPF program ID through two memory accesses. The eBPF program ID is stored in an eBPF program auxiliary structure associated with the eBPF program, and the eBPF program structure stores a pointer to this auxiliary structure (a nested structure pointer). Therefore, you can first obtain a pointer to the eBPF program auxiliary structure by accessing a field of the eBPF program structure. Then, use the obtained pointer to access a field of the eBPF program auxiliary structure to finally obtain the ID.
[0033] (2.2) Based on the ID of the eBPF program structure, a corresponding valid eBPF program structure pointer is searched from the set of valid eBPF program structure pointers. If the eBPF program structure pointer to be checked matches the value of the corresponding valid eBPF program structure pointer, then the eBPF program is valid. In this specific embodiment of the invention, the corresponding valid eBPF program structure pointer is searched from the set of eBPF program structure pointers using the ID of the eBPF program structure as a guide, and then compared. Compared with the one-to-one comparison in the prior art, the performance overhead is greatly reduced.
[0034] In one specific embodiment, the present invention provides that identified data directly or indirectly related to the program counter data stream is used as a target object that is easily tampered with by malicious eBPF bytecode. Specifically, the directly related data provided in this embodiment is data that is directly operated on by the pointer of the program counter data stream, and the indirectly related data is data that is indirectly operated on by the pointer of the program counter data stream through recursive searching. For example, by recursively searching for data that is directly or indirectly operated on by the directly related data, the target object that is easily tampered with by malicious eBPF bytecode can be found as much as possible.
[0035] In one specific embodiment, the present invention filters the obtained eBPF interpretation stream data before tracking the program counter data stream of the eBPF interpreter, removing data marked as read-only because it cannot be overwritten to manipulate the interpretation stream and therefore cannot be maliciously tampered with, thereby reducing the number of targets that need to be protected.
[0036] In one specific embodiment, this invention searches for functions in the Linux kernel that use the target object. These functions are interpreter functions, i.e., specific entry points. These entry points execute eBPF programs and therefore can use the target object. Furthermore, the use of the target object by these entry points can be found in the code. Therefore, this protection sets a checkpoint at the entry point of the interpreter function to verify the legitimacy of the eBPF program to be executed.
[0037] In one specific embodiment, this invention can also set a checkpoint at the tail call processing branch of the function to verify the legitimacy of the eBPF program. Considering that attackers can trigger malicious bytecode through the tail call mechanism, this protection also sets a checkpoint in the tail call processing branch of the interpreter function (before the execution of the tail call program) to verify the legitimacy of the subroutine executed through the tail call initiated by the main program, thereby ensuring that the detection can cover all paths where the interpreter executes eBPF bytecode.
[0038] In one specific embodiment, before accessing the id of the eBPF program structure pointer to be checked via the pointer corresponding to the field, this embodiment of the invention checks the field using a memory access security check function. When reading object fields, since the object may be forged by an attacker, its fields (pointers) may point to an illegal address. To prevent the kernel from crashing due to illegal memory access, this protection checks the security of the memory access before accessing untrusted memory via a potentially manipulated pointer. Only if the target address is legitimate is the memory access allowed; otherwise, the object is considered to have been tampered with, and the execution of the eBPF program is rejected.
[0039] In one specific embodiment, this invention utilizes the Linux kernel's identifier reverse mapping structure and retrieval interface to search for the corresponding valid eBPF program structure pointer from a set of valid eBPF program structure pointers based on the eBPF program structure pointer to be inspected. This avoids extensive modifications to the kernel while ensuring that the search operation does not introduce unacceptable performance overhead.
[0040] In one specific embodiment, for cases where the eBPF program pointer cannot be directly obtained (only the bytecode pointer can be obtained), the present invention infers the corresponding eBPF program pointer from the bytecode pointer. Since the bytecode is a field of the eBPF program structure, this protection first uses a kernel-provided macro that obtains the pointer to the entire structure based on the pointer of a member in the structure to obtain the pointer to the eBPF program corresponding to the bytecode.
[0041] In one specific embodiment, the present invention provides specific steps for verifying the legality of an eBPF program at a set checkpoint, such as... Figure 2 As shown:
[0042] ① Accessing the field of an eBPF program structure to obtain its ID. First, read the nested structure pointer field in the eBPF program structure to obtain a pointer to the eBPF program auxiliary structure. Next, read the id field in the eBPF program auxiliary structure to obtain its program ID. Because structures can be forged by attackers, when using pointers to its fields (including fields of its nested structure objects) for memory access, it is necessary to first call the memory access security check function to check the security of the memory (check whether the pointer is in a mapped and legitimate memory space) to prevent kernel crashes.
[0043] ② Query the eBPF identifier reverse mapping object to obtain a valid eBPF program pointer. This protection uses the program ID obtained in step ① as the key and calls the identifier reverse mapping object retrieval function (a general retrieval interface provided by the kernel) to query the eBPF identifier reverse mapping object (the set of valid bytecode). In this way, pointers to valid eBPF programs assigned to that ID, maintained by eBPF, can be retrieved. The performance overhead of this protection is concentrated on the retrieval operation of the valid bytecode set. Since the valid bytecode sets are organized into a radix tree type data structure, the average time complexity of searching them is constant. The check is only initiated when an eBPF program is executed by the interpreter, so the overall performance overhead is within an acceptable range.
[0044] ③ Compare the passed-in eBPF program pointer with the query result. Finally, the provided program pointer (memory address) needs to be compared with the pointer (memory address) of a valid program. If step ② returns a null pointer (NULL) or is different from the pointer of the program to be checked, the bytecode is considered illegally injected, and execution is rejected. The provided bytecode is considered valid only if the addresses match, and the interpreter then begins to execute the bytecode.
[0045] This paper adds checks at the interpreter's entry point and the tail call handling branch. In the kernel, the eBPF interpreter is implemented as a set of functions with different pseudo-stack sizes. The kernel uses a macro to define its function bodies, so this paper modifies that macro, adding a checkpoint at the beginning of the interpreter functions. For the tail call check, this paper modifies the tail call handling branch in the interpreter. In this branch, the kernel uses the file descriptor and index as keys to look up a map of program array type to obtain a pointer to the target subroutine to be tail-called. This protection sets a checkpoint before the kernel accesses its bytecode fields to obtain the bytecode.
[0046] This invention discloses a method for protecting against malicious eBPF bytecode based on identifier reverse mapping matching. This method dynamically prevents the execution of malicious eBPF bytecode by adding a check on the legitimacy of the eBPF program to the eBPF interpreter. Utilizing the kernel's existing identifier reverse mapping structure and related retrieval interfaces, this method verifies the legitimacy of the eBPF program to be executed before its bytecode is executed by matching its ID with the address of the corresponding legitimate program in a verified bytecode set. This rejects the execution of illegitimate eBPF programs, effectively ensuring the security of the eBPF subsystem.
[0047] Compared to existing kernel protections (such as non-executable data protection and control flow integrity protection), this method verifies the legitimacy of eBPF bytecode through identifier reverse mapping matching, dynamically preventing the execution of malicious eBPF programs and effectively resisting eBPF interpreter flow hijacking attacks, thus filling the gaps in existing kernel protections. Secondly, this protection fully reuses the original data structures and interfaces of the Linux kernel, keeping modifications to the Linux kernel to a minimum. Furthermore, this protection only requires modification to the relatively simple eBPF interpreter, without involving complex verifiers, thus minimizing the possibility of introducing new risks. Finally, this protection is transparent to user processes and will not affect the existing eBPF ecosystem. Because the protection does not modify the eBPF specification or user interfaces, user-space eBPF programs and related interfaces do not need to be re-adapted.
[0048] It will be understood by those skilled in the art that the above description is merely a single example of the invention and is not intended to limit the invention. Although the invention has been described in detail with reference to the foregoing examples, those skilled in the art can still modify the technical solutions described in the foregoing examples or make equivalent substitutions for some of the technical features. All modifications and equivalent substitutions made within the spirit and principles of the invention should be included within the scope of protection of the invention.
Claims
1. A protection method against malicious eBPF bytecode, characterized in that, include: (1) Trace the program counter data stream of the eBPF interpreter and identify data that is directly or indirectly related to the program counter data stream as target objects that are easily tampered with by malicious eBPF bytecode. Data identified as directly or indirectly related to the program counter data stream is considered as target objects susceptible to malicious eBPF bytecode tampering, where: The directly related data refers to the data that is directly manipulated by the pointer of the program counter data stream; The indirectly related data is the data that is indirectly operated by recursively searching for pointers to the program counter data stream; (2) Search for functions that use the target object in the Linux kernel, and set checkpoints at the entry point of the function to verify the legality of the eBPF program; Verify the legitimacy of the eBPF procedure at the set checkpoints, including: Accessing the field of an eBPF program structure to obtain its ID involves: first, reading the nested structure pointer field in the eBPF program structure to obtain a pointer to the eBPF program auxiliary structure, and then reading the id field in the eBPF program auxiliary structure to obtain its program ID; The process involves querying the eBPF identifier reverse mapping object to obtain a valid eBPF program pointer, specifically including: [steps to be filled in]. The program ID obtained in the process is used as the key to call the retrieval function of the identifier reverse mapping object to query the identifier reverse mapping object of eBPF. The retrieval function is a general retrieval interface provided by the kernel, which retrieves the pointer maintained by eBPF to the valid eBPF program that has been assigned the ID. Compare the passed-in eBPF program pointer with the query result; if the step... If the returned bytecode is a null pointer or is different from the pointer to be checked, the bytecode is considered to be illegally injected and execution is rejected. The provided bytecode is considered legal only if the address matches, and then the interpreter begins to execute the bytecode.
2. The protection method against malicious eBPF bytecode according to claim 1, characterized in that, Before tracing the program counter data stream of the eBPF interpreter, the obtained eBPF interpreter stream data is filtered to remove data marked as read-only.
3. The protection method against malicious eBPF bytecode according to claim 1, characterized in that, The system searches for functions in the Linux kernel that use the target object, specifically interpreter functions.
4. The protection method against malicious eBPF bytecode according to claim 1, characterized in that, It is also possible to set checkpoints at the end of the function's call processing branch to verify the legitimacy of the eBPF program.
5. The protection method against malicious eBPF bytecode according to claim 1, characterized in that, Before accessing the id of the eBPF program structure pointer to be checked through the pointer corresponding to the field, the field is checked by a memory access security check function.
6. The protection method against malicious eBPF bytecode according to claim 1, characterized in that, In cases where the eBPF program pointer cannot be obtained directly, the address of the object can be indirectly inferred through the bytecode fields within the eBPF program object.