The eBPF technology in the Linux kernel has been widely adopted for different applications, such as networking, tracing, and security, thanks to the programmability it provides. By allowing user-supplied eBPF programs to be executed directly in the kernel, it greatly increases the flexibility and efficiency of deploying customized logic. However, eBPF also introduces a new and wide attack surface: malicious eBPF programs may try to exploit the vulnerabilities in the eBPF subsystem in the kernel. Fuzzing is a promising technique to find such vulnerabilities. Unfortunately, our experiments with the state-of-the-art kernel fuzzer, Syzkaller, shows that it cannot effectively fuzz the eBPF runtime, those components that are in charge of executing an eBPF program, for two reasons. First, the eBPF verifier (which is tasked with verifying the safety of eBPF programs) rejects many fuzzing inputs because (1) they do not comply with its required semantics or (2) they miss some dependencies, i.e., other syscalls that need to be issued before the program is loaded. Second, Syzkaller fails to attach and trigger the execution of eBPF programs most of the times. This paper introduces the BPF Runtime Fuzzer (BRF), a fuzzer that can satisfy the semantics and dependencies required by the verifier and the eBPF subsystem. Our experiments show, in 48-hour fuzzing sessions, BRF can successfully execute 8x more eBPF programs compared to Syzkaller. Moreover, eBPF programs generated by BRF are much more expressive than Syzkaller's. As a result, BRF achieves 101% higher code coverage. Finally, BRF has so far managed to find 4 vulnerabilities (some of them have been assigned CVE numbers) in the eBPF runtime, proving its effectiveness.

翻译：Linux内核中的eBPF技术因其提供的可编程性，已被广泛应用于网络、追踪和安全等不同领域。通过允许用户提供的eBPF程序直接在内核中执行，它极大地提升部署定制逻辑的灵活性与效率。然而，eBPF也引入了一个全新的广阔攻击面：恶意eBPF程序可能试图利用内核中eBPF子系统的漏洞。模糊测试是发现此类漏洞的有效技术。但我们的实验表明，现有最先进的内核模糊测试器Syzkaller无法有效对负责执行eBPF程序的eBPF运行时组件进行模糊测试，原因有二：首先，eBPF验证器（负责验证eBPF程序安全性）会拒绝大量模糊测试输入，因为这些输入（1）不符合其要求的语义，或（2）缺少某些依赖条件（即在程序加载前需先执行的其他系统调用）；其次，Syzkaller大多数情况下无法成功附加并触发eBPF程序的执行。本文提出BPF运行时模糊测试器（BRF），该模糊测试器能够满足验证器与eBPF子系统所需的语义和依赖条件。我们的实验表明，在48小时的模糊测试会话中，BRF成功执行的eBPF程序数量是Syzkaller的8倍以上。此外，BRF生成的eBPF程序比Syzkaller的更具表达能力。因此，BRF实现了101%更高的代码覆盖率。最后，BRF目前已成功发现eBPF运行时中的4个漏洞（部分已分配CVE编号），证明了其有效性。