Project Description

BPF verifier plays a crucial role in securing the system (though less so now that unprivileged BPF is disabled by default in both upstream and SLES), and bugs in the verifier has lead to privilege escalation vulnerabilities in the past (e.g. CVE-2021-3490).

One way to check whether the verifer has bugs to use model checking (a formal verification technique), in other words, build a abstract model of how the verifier operates, and then see if certain condition can occur (e.g. incorrect calculation during value tracking of registers) by giving both the model and condition to a solver.

For the solver I will be using the Z3 SMT solver to do the checking since it provide a Python binding that's relatively easy to use.

Goal for this Hackweek

Learn how to use the Z3 Python binding (i.e. Z3Py) to build a model of (part of) the BPF verifier, probably the part that's related to value tracking using tristate numbers (aka tnum), and then check that the algorithm work as intended.

Resources

Looking for hackers with the skills:

bpf ebpf formalverification modelchecking kernel security

This project is part of:

Hack Week 21 Hack Week 23 Hack Week 24

Activity

  • 5 days ago: janvhs liked this project.
  • 6 days ago: flonnegren liked this project.
  • 7 days ago: vliaskovitis liked this project.
  • 23 days ago: r1chard-lyu liked this project.
  • 12 months ago: moio liked this project.
  • over 2 years ago: dsterba liked this project.
  • over 2 years ago: mbrugger liked this project.
  • over 2 years ago: jzerebecki left this project.
  • over 2 years ago: jzerebecki added keyword "security" to this project.
  • over 2 years ago: jzerebecki joined this project.
  • over 2 years ago: jzerebecki liked this project.
  • over 2 years ago: ailiopoulos liked this project.
  • over 2 years ago: shunghsiyu started this project.
  • over 2 years ago: shunghsiyu added keyword "kernel" to this project.
  • over 2 years ago: shunghsiyu added keyword "bpf" to this project.
  • over 2 years ago: shunghsiyu added keyword "ebpf" to this project.
  • over 2 years ago: shunghsiyu added keyword "formalverification" to this project.
  • over 2 years ago: shunghsiyu added keyword "modelchecking" to this project.
  • over 2 years ago: shunghsiyu originated this project.

  • Comments

    • shunghsiyu
      over 2 years ago by shunghsiyu | Reply

      I've uploaded the jupyter notebook on GitHub that contains a minimal model of tnum along with tnum_add(), as well as the prove that it works.

    • shunghsiyu
      over 2 years ago by shunghsiyu | Reply

      The slides used for lightning talk can be found here

      While I'd like to achieve much more, I think what I've done during hack week is suffice to be called a complete project, so I'm marking this as complete

    • shunghsiyu
      about 1 year ago by shunghsiyu | Reply

      I'm restarting this project to model check the range tracking (minimal and maximal value possible in s32/u32/u64/s64 range) done in BPF verifier.

      In addition to that I hope to unify signed and unsigned range tracking based on previously posted idea and the "Interval Analysis and Machine Arithmetic: Why Signedness Ignorance Is Bliss" paper for simpler range tracking code.

    Similar Projects

    Tracing system calls with eBPF by doreilly

    Description

    Many security tools need to rec...


    Tracing system calls with eBPF by doreilly

    Description

    Many security tools need to rec...


    Modularization and Modernization of cifs.ko for Enhanced SMB Protocol Support by hcarvalho

    Creator:<br> Enzo Matsumiya ematsumiya@suse.de...


    Contributing to Linux Kernel security by pperego

    Description

    A couple of weeks ago, I foun...


    Linux on Cavium CN23XX cards by tsbogend

    Before Cavium switched to ARM64 CPUs they devel...


    Officially Become a Kernel Hacker! by m.crivellari

    Description

    My studies as well my spare tim...


    Improve UML page fault handler by ptesarik

    Description

    Improve UML handling of segment...


    Migrate from Docker to Podman by tjyrinki_suse

    Description

    I'd like to continue my [form...


    Linux Security and Practice by r1chard-lyu

    Description

    This project focuses on discove...


    CVE portal for SUSE Rancher products by gmacedo

    Description

    Currently it's a bit difficul...


    Contributing to Linux Kernel security by pperego

    Description

    A couple of weeks ago, I foun...


    Kanidm: A safe and modern IDM system by firstyear

    Kanidm is an IDM system written in Rust for mod...