eBPF Foundation unveils security threat model & audit

The eBPF Foundation has announced the availability of two reports focused on the security of eBPF, highlighting an eBPF Security Threat Model by ControlPlane and an eBPF Verifier Code Audit by NCC Group.

The Security Threat Model conducted by ControlPlane aims to provide guidance for deploying eBPF securely, addressing potential threats and vulnerabilities. The research acknowledges eBPF as a highly secure technology due to its built-in security features, including a verifier that ensures the safety of eBPF programs.

The threat modelling approach focused on understanding the fundamentals of eBPF, identifying potential security risks through developing attack trees, and mapping these threats to inherent controls and user recommendations. This process concludes with a review of the threat model outcomes, providing practical guidance for eBPF adopters.

Several recommendations were noted in the threat model for addressing identified security concerns. These included adhering to the Least Privilege Principle by granting eBPF programs only necessary permissions, ensuring the integrity of eBPF tools and libraries through supply chain security, and keeping kernel and eBPF tools current with the latest security patches.

Further recommendations included implementing monitoring and logging to detect and respond to incidents, conducting regular threat modelling exercises, and disabling unprivileged eBPF by default to minimise the attack surface.

The eBPF Foundation also engaged NCC Group for a comprehensive security source code review of the eBPF Verifier, a crucial component in eBPF's security infrastructure. This audit focused on identifying the properties the verifier is trying to prove and examining the main logic invoked through relevant kernel functions.

The review found the eBPF community to be highly effective in identifying and rectifying bugs. However, it noted some vulnerabilities, most notably a flaw allowing a privileged attacker to read and write arbitrary kernel memory. This vulnerability has since been addressed by the community.

Additional recommendations were made by the NCC Group to improve verifier security, including refactoring complex functions and enhancing documentation regarding what the verifier enforces.

Thomas Graf, Chair of the eBPF Foundation Governing Board and Co-Founder and CTO of Isovalent, commented on the importance of proactive security approaches in eBPF: "While eBPF is a powerful tool, it's crucial to adopt a proactive security approach, like the third party security audit we just completed. Furthermore, by understanding the potential risks and implementing the recommended mitigation strategies from the threat model, organizations can leverage eBPF safely and securely."