SUSE Hack Week: Model checking the BPF verifier

Project Description

BPF verifier plays a crucial role in securing the system (though less so now that unprivileged BPF is disabled by default in both upstream and SLES), and bugs in the verifier has lead to privilege escalation vulnerabilities in the past (e.g. CVE-2021-3490).

One way to check whether the verifer has bugs to use model checking (a formal verification technique), in other words, build a abstract model of how the verifier operates, and then see if certain condition can occur (e.g. incorrect calculation during value tracking of registers) by giving both the model and condition to a solver.

For the solver I will be using the Z3 SMT solver to do the checking since it provide a Python binding that's relatively easy to use.

Goal for this Hackweek

Learn how to use the Z3 Python binding (i.e. Z3Py) to build a model of (part of) the BPF verifier, probably the part that's related to value tracking using tristate numbers (aka tnum), and then check that the algorithm work as intended.

Resources

Formal Methods for the Informal Engineer: Tutorial #1 - The Z3 Theorem Prover and its accompanying notebook is a great introduction into Z3
- Has a section specifically on model checking
Software Verification and Analysis Using Z3 a great example of using Z3 for model checking
Sound, Precise, and Fast Abstract Interpretation with Tristate Numbers - existing work that use formal verification to prove that the multiplication helper used for value tracking work as intended
[PATCH v5 net-next 00/12] bpf: rewrite value tracking in verifier - initial patch set that adds tristate number to the verifier

Looking for hackers with the skills:

bpf ebpf formalverification modelchecking kernel security

This project is part of:

Hack Week 21

Activity

7 months ago: dsterba liked this project.

7 months ago: mbrugger liked this project.

7 months ago: jzerebecki left this project.

7 months ago: jzerebecki added keyword "security" to this project.

7 months ago: jzerebecki joined this project.

7 months ago: jzerebecki liked this project.

7 months ago: ailiopoulos liked this project.

7 months ago: shunghsiyu started this project.

7 months ago: shunghsiyu added keyword "kernel" to this project.

7 months ago: shunghsiyu added keyword "bpf" to this project.

7 months ago: shunghsiyu added keyword "ebpf" to this project.

7 months ago: shunghsiyu added keyword "formalverification" to this project.

7 months ago: shunghsiyu added keyword "modelchecking" to this project.

7 months ago: shunghsiyu originated this project.

Comments

7 months ago by shunghsiyu | Reply

I've uploaded the jupyter notebook on GitHub that contains a minimal model of tnum along with tnum_add(), as well as the prove that it works.

7 months ago by shunghsiyu | Reply

The slides used for lightning talk can be found here

While I'd like to achieve much more, I think what I've done during hack week is suffice to be called a complete project, so I'm marking this as complete

Project Description

Due previous hackweek...

Project Description

The goal of the proje...

Project Description

Goal for this Hackweek

Resources

Looking for hackers with the skills:

This project is part of:

Activity

Comments

7 months ago by shunghsiyu | Reply

7 months ago by shunghsiyu | Reply

Similar Projects

kernel

Create a DRM driver for VGA video cards by tdz

Improve Qualcomm SOC msm8994/msm8992 kernel mainline support by pvorel

Project Description

early stage kdump support by mbrugger

Understand and review klp-convert patchset by mpdesouza

drgn: implement crash top-level commands by marxin

Project Description

security

Force USB devices to be read from a virtual machine on a given PC by nguyens

Run sandboxed Firefox with image and sound inside a container by nguyens

Rancher Token Revoker by mbolot

Create tool for managing RPM package signing keys by dheidler