eBPF Security Boundaries & Verifier Barrier Matrix

Simulation Controls & Attack Vectors

v6.1-LTS (x86_64)

Target Architecture

Kernel Version

Offensive Payload Vector & Hook Point

Payload Implementation Invariants

Bounded Loop Guard (Check verifier instruction limit)

Enable CO-RE BTF Struct Field Relocations

Execute in CAP_BPF / CAP_SYS_ADMIN (Privileged Context)

Kernel Verifier Decision Surface

EACCES

REJECTED_VERIFIER_EACCES ret -13

Barrier Class: Kernel Verifier / BPF Type Format (BTF)

Offensive hook blocked by verifier bounded stack limit and prohibited write-user helper in non-permissive unpriv context.

Prog Load Events

CPU Cycle Cost

420

Ring Buf Overrun Risk

low

[root@kernel-matrix ~]# bpftool prog load ./payload.bpf.o /sys/fs/bpf/offensive_hook type kprobe 0: (79) r1 = *(u64 *)(r1 +16) ; R1_w=ctx(off=16,imm=0) 1: (85) call pc+14 ; bpf_probe_write_user 2: (bf) r2 = r10 3: (07) r2 += -8 ; R2_w=fp-8 R1 type=ctx expected=fp-8 invalid mem access 'inv' at offset 16 -- kernel verifier: rejected program after 4 instructions (limit 1000000) --

CO-RE BTF Relocation Analysis: x86_64 vs ARM64 Struct Drift

BTF v1 Deduplicated

Empirical observation of offsets inside critical kernel structures (e.g. struct task_struct, struct cred) across architectures and kernel iterations. When offensive payloads use hardcoded pointer offsets without CO-RE, memory reads fail or kernel page fault occurs.

Target Struct & Member	Kernel Version	x86_64 Offset	ARM64 Offset	Offset Delta	Offensive Consequence without CO-RE
`task_struct->cred`	v5.4 LTS	0x0AD8 (2776)	0x09B0 (2480)	+296 bytes	Crash / Bad Ptr Reads junk pointer; verifier restricts in v5.15+
`task_struct->cred`	v6.1 LTS	0x0B48 (2888)	0x0A20 (2592)	+296 bytes	Inv Mem Deref CO-RE relocation required; raw offset points to thread_info
`task_struct->comm[16]`	v6.1 vs v6.8	0x0A90 -> 0x0AB0	0x0968 -> 0x0988	+32 bytes	Telemetry Skew Spoofing process name fails or alters audit flags
`cred->euid`	v5.10 vs v6.6	0x0014 (20)	0x0014 (20)	0 bytes	Stable Immutable via bpf_probe_read_kernel; write blocked by Verifier
`linux_binprm->file`	v6.1 LTS	0x0038 (56)	0x0038 (56)	0 bytes	LSM Block Prohibited helper write-user on executable file descriptors

Master's Thesis Formal Methodology Blueprint

Peer-Review Ready Structure

1. Experimental Variable Control

Isolate Kernel Configurations (CONFIG_BPF_UNPRIV_DEFAULT_OFF=y, CONFIG_DEBUG_INFO_BTF=y). Ensure benchmark fixtures run against matched hardware configurations on both x86_64 (KVM guest) and ARM64 (QEMU/Graviton).

2. Verifier Pushback Metrics

Collect raw verifier instruction counts, stack depth allocations, register state graph complexities, and exact error codes (-EACCES, -E2BIG, -EINVAL) to map verifiable offensive state boundaries.

3. Evading vs. Detection Telemetry

Benchmark cycle penalty: Hooking sys_enter_execve with credential rewriting incurs 380–940 CPU cycles per invocation. Contrast this footprint against high-frequency ring-buffer monitoring.