MOAT: Towards Safe BPF Kernel Extension

Hongyi Lu,Shuai Wang,Yechang Wu,Wanning He,Fengwei Zhang

2024-06-07

Abstract:The Linux kernel extensively uses the Berkeley Packet Filter (BPF) to allow user-written BPF applications to execute in the kernel space. The BPF employs a verifier to check the security of user-supplied BPF code statically. Recent attacks show that BPF programs can evade security checks and gain unauthorized access to kernel memory, indicating that the verification process is not flawless. In this paper, we present MOAT, a system that isolates potentially malicious BPF programs using Intel Memory Protection Keys (MPK). Enforcing BPF program isolation with MPK is not straightforward; MOAT is designed to alleviate technical obstacles, such as limited hardware keys and the need to protect a wide variety of BPF helper functions. We implement MOAT on Linux (ver. 6.1.38), and our evaluation shows that MOAT delivers low-cost isolation of BPF programs under mainstream use cases, such as isolating a BPF packet filter with only 3% throughput loss.

Cryptography and Security,Operating Systems

What problem does this paper attempt to address?

The paper aims to address the security issues faced by the Berkeley Packet Filter (BPF) in the Linux kernel. Specifically:

1. **Background and Issues**:
- BPF allows user-written programs to execute in kernel space, but the existing BPF verifier has vulnerabilities that allow malicious programs to bypass security checks and gain unauthorized access to kernel memory.
- Although the current BPF verifier performs static analysis to ensure the safety of user-provided code, these verification processes are not perfect and can still be exploited.

2. **Main Objectives**:
- Propose a system named MOAT that utilizes Intel Memory Protection Keys (MPK) technology to isolate potentially malicious BPF programs.
- Achieve low-overhead and secure BPF program isolation through hardware extensions (MPK), thereby enhancing the security of the BPF ecosystem.

3. **Specific Challenges**:
- MPK provides a maximum of 16 protection keys, making it a challenge to support a large number of BPF programs.
- Preventing the misuse of BPF helper functions is also an important issue.

4. **Solutions**:
- Designed a novel two-layer isolation scheme that combines MPK and isolated address spaces to address the limited number of hardware keys.
- Utilized modern hardware features like Process Context Identifier (PCID) to minimize the overhead caused by isolation.
- Implemented a MOAT prototype and evaluated it on Linux 6.1.38, showing that MOAT effectively mitigates known CVE vulnerabilities with low performance overhead.

In summary, the main goal of this paper is to enhance the security of BPF through hardware-assisted methods, making BPF both secure and easy to use, especially in non-privileged user scenarios.