Attacking and Securing eBPF Maps [video]
This video explores attack vectors and security measures related to eBPF maps, covering how malicious actors might exploit them and techniques to defend against such attacks.
Background
- eBPF is a Linux kernel technology that lets users run sandboxed programs inside the kernel without changing kernel source code or loading modules. It's widely used for performance monitoring, networking, and security tooling.
- eBPF "maps" are key-value data structures that allow eBPF programs to share state with each other and with user-space programs. They are a central component of many eBPF-based tools.
- This talk covers security vulnerabilities specific to eBPF maps—attacks that exploit race conditions, memory corruption, or improper access control in map operations—and presents mitigation strategies.
- The speaker demonstrates real attacks against production-grade eBPF runtimes and shows how to harden systems against them. The talk assumes familiarity with eBPF internals; the background brief is for viewers who know eBPF exists but not how maps work or why they introduce unique security risks.