Search papers, labs, and topics across Lattice.
The paper identifies six classes of source-level bugs in eBPF programs that bypass the kernel verifier, leading to data corruption, information leaks, and incorrect enforcement. To address these vulnerabilities and facilitate safer migration, they introduce Heimdall, an automated pipeline leveraging LLMs to translate legacy libbpf C programs to Aya Rust. Heimdall achieves a 94.1% success rate in producing formally proven-equivalent translations across 102 eBPF programs, ensuring preservation of observable behavior.
Ten open-source eBPF programs silently leak sensitive user data and kernel secrets into userspace, highlighting critical vulnerabilities that existing kernel verification fails to catch.
Extended Berkeley Packet Filter (eBPF) programs are kernel extensions used for networking, observability, and security enforcement in the Linux kernel. The in-kernel eBPF verifier checks low-level memory safety and termination on eBPF programs, but it does not enforce many higher-level source-level properties, such as initialization discipline, schema consistency, or error handling. We document six classes of source-level bugs that compile, pass the kernel verifier, and can silently corrupt data, leak previously traced events to userspace, or yield incorrect enforcement outcomes. Among these, we identify previously unreported information leaks in ten open-source eBPF programs whose ring-buffer or stack-resident event records carry fully decodable prior traced events, including user-identifying paths and recurring kernel-text return addresses sufficient to recover the KASLR slide on every event, into userspace. To harden such verifier-accepted buggy programs and support safe migration, we present Heimdall, an automated pipeline that uses large language models to translate legacy libbpf C programs to Aya Rust. Heimdall iteratively repairs compilation and kernel-verifier failures, rejects unsafe escape hatches in Rust-Aya with a static analysis safety engine, and proves per-program equivalence to the original via symbolic execution and Z3-based equivalence checking. Across 102 eBPF programs, Heimdall produces 96 formally proven-equivalent translations (94.1%). Heimdall is the first system to automate memory-safe-language migration of production eBPF programs with per-program formal guarantees that the migration preserves observable behavior.
