Down the pipe: A SoK on eBPF pipeline security

Authors:
Preprint
Publisher website
Google Scholar
Abstract
The extended Berkeley Packet Filter (eBPF) has emerged as a powerful mechanism for extending kernel functionality. It enables observability, security monitoring, and network control. The reliability of this system depends on a pipeline encompassing compilation, static verification, and in-kernel execution. Each of these stages depends on some safety constraints and operational assumptions. We start by explaining this pipeline from a security standpoint, with an emphasis on the coherence of its elements’ security assumptions. Building on this, we present a review of the existing methods for identifying security flaws and the proposed techniques in the literature for strengthening the eBPF ecosystem. Our review indicates that fuzz testing is the most prevalent and effective approach for identifying both bugs and vulnerabiliies. Furthermore, modifications of prior attacks offer targeted insights into high-impact weaknesses. A comparison with publicly disclosed Common Vulnerabilities and Exposures (CVEs) reveals a significant misalignment between academic focus and real-world failure patterns. Specifically, maps and helpers subsystems account for some of the most present vulnerabilities but receive limited attention in published research. Additionally, we have categorized the existing defensive proposals, with notable trends identified in memory isolation, verifier redesign, and runtime hardening. These findings underscore structural gaps in the current literature and motivate the development of more integrated approaches.