AI
Why eBPF Should Terrify Security Professionals
eBPF started as a simple packet filter. Today it is a virtual machine with ring‑zero privileges, direct kernel memory access, and persistence across reboots. Ubuntu, Red Hat, and Alma Linux ship it enabled by default. The verifier alone is 15,000 lines of C code. Panico cataloged over 200 vulnerability patterns inside it — integer overflows, type confusion, state corruption, loop bound bypasses, stack overflows. Every new eBPF feature expands the attack surface.
Why Traditional Fuzzing Fails
Random mutation generates programs that the verifier blocks 99.99% of the time. Static analysis cannot model the verifier’s state machine. Manual analysis takes months per bug. eBPF kernel developers add features faster than researchers can analyze them. The missing piece is state awareness: traditional tools do not track the verifier’s internal state, cannot target bound calculation errors or type confusion, and have no systematic approach to the JIT compiler.
Leviathan: State-Aware Fuzzing and Exploitation
Leviathan generates programs that target specific vulnerability classes in the verifier’s state tracking. It integrates coverage-guided fuzzing (90% basic block coverage), differential fuzzing across kernel versions, and a neural model for instruction generation. In 24 hours it produces roughly two million compilable programs. Over four weeks it achieved 70% edge coverage on x86, ARM, RISC‑V, and PowerPC. The framework converts verifier bypasses into arbitrary read/write primitives, KASLR leaks, and full privilege escalation chains.
Live Demo: From Fuzzing to Privilege Escalation
Panico ran Leviathan against a vulnerable kernel. Out of ten generated programs, six produced a crash. After static analysis, three were verified as real vulnerabilities. The framework then automatically built exploit primitives from those findings. He added remote test machines, and the exploit chain succeeded at a 90% rate across all platforms. The final output was C code ready for local or remote execution. The same frame work can analyze real‑world eBPF tools like Cilium and Calico by tracing their BPF programs.
Defensive Recommendations and Future Work
Runtime protections require input validation and capability restrictions on all eBPF helper functions. Real‑time detection of exploitation attempts should be deployed. Auditing and monitoring of eBPF usage is largely absent today. Panico plans to extend state modeling with machine learning, add formal verification for post‑quantum crypto, and explore hardware integration. Windows is implementing eBPF — a new attack surface that Panico calls a research opportunity.
Notable Quotes
the verifier it’s one of the beautiful the most beautiful piece of code that I’ve ever seen Agostino “Van1sh” Panico · ▶ 6:46
random mutation gets blocked immediately Agostino “Van1sh” Panico · ▶ 13:56
every new BPF ABPF feature increase the attack surface Agostino “Van1sh” Panico · ▶ 8:12
Key Takeaways
- eBPF’s verifier, JIT, helpers, and maps form a ring‑zero attack surface that grows with every kernel release.
- Leviathan uses state‑aware fuzzing to find vulnerabilities traditional fuzzers miss, achieving 70% code coverage.
- The framework automates the full exploit chain from vulnerability detection to privilege escalation with 90% reliability.
About the Speaker(s)
Dr. Agostino “van1sh” Panico is a seasoned offensive security expert with over 15 years of experience in advanced red teaming, exploit development, product security testing, and deception tactics. He holds the GIAC Security Expert (GSE) certification, a distinction held by fewer than a few hundred people globally. Panico is the author and maintainer of the Leviathan framework and also maintains a fork of the SpiderFoot project. He is an organizer of BSides Italy.