The extended Berkeley Packet Filter (eBPF) is useful for faster packet processing and network monitoring in softwarized deployments. Similarly, softwarized deployments of 5G core network services adopted eBPF to meet the stringent latency and bandwidth requirements of underlying applications. While the existing studies focused on network performance, security concerns over eBPF-enabled platforms are overlooked. In this paper, we study the vulnerability analysis of 5G core network deployments that use eBPF for packet processing and traffic monitoring. In particular, we consider the following aspects: a) tracing, b) denial-of-service (DoS), c) stealing information, and d) bash injection. We present the detailed attack scenarios with step-by-step implementation of containerized and eBPF-enabled 5G network functions using Open5GS. The experiment results show that the aforementioned vulnerabilities are present in eBPF-enabled 5G deployments and can be exploited by attackers. Finally, we present some mitigation techniques useful for addressing the vulnerabilities. The source code and implementation details are made available at https://github.com/chimms1/5G-eBPF-exploits.

翻译：扩展伯克利包过滤器（eBPF）在软化部署中有利于实现更快的包处理和网络监控。同样地，5G核心网络服务的软化部署采用eBPF以满足底层应用对延迟和带宽的严苛要求。尽管现有研究聚焦于网络性能，但对支持eBPF平台的安全隐患关注不足。本文针对使用eBPF进行包处理与流量监控的5G核心网络部署开展脆弱性分析。具体而言，我们考虑以下方面：a) 跟踪、b) 拒绝服务（DoS）、c) 信息窃取及d) bash注入。通过基于Open5GS的容器化eBPF使能5G网络功能逐步实施，我们展示了详细的攻击场景。实验结果表明，上述脆弱性存在于支持eBPF的5G部署中，并可能被攻击者利用。最后，我们提出若干有助于解决这些脆弱性的缓解技术。相关源代码与实现细节已发布于https://github.com/chimms1/5G-eBPF-exploits。