EKFuzz: Fuzzing the BPF subsystem

The extended Berkeley Packet Filter (eBPF) framework has revolutionized the way developers interact with the Linux kernel by enabling safe, dynamic programmability. However, this flexibility comes at a cost. The new kernel functions (kfuncs) exposed to eBPF programs are rapidly proliferating, often without adequate testing. While prior work has addressed verifier and helper function fuzzing, the kfuncs remain a largely unexplored attack surface. This thesis presents EKFuzz, a Syzkaller-based fuzzing extension that systematically targets kfuncs used by eBPF programs. EKFuzz incorporates type-aware generation of verifier-compliant programs, automatically generates dependent syscalls (e.g., for maps), and employs a mutation-driven feedback loop. Our evaluation demonstrates that EKFuzz achieves deeper runtime coverage than Syzkaller and uncovers latent bugs within the kfunc execution paths.

Name thesis:degree_name

Master of Science

Level thesis:degree_level

masters

Discipline thesis:degree_discipline

Computer Engineering

Department dc:contributor.department

Electrical and Computer Engineering

Grantor dc:publisher

Virginia Tech

Year dc:date.issued

2025

Author dc:creator

• Puranam, Ananta Srikar

Chair dc:contributor.committeechair

• Ravindran, Binoy

Committee members dc:contributor.committeemember

• Wang, Haining
• Giles, Kendall Everett

• Linux
• Fuzzing
• eBPF
• syzkaller
• EKFuzz

Statement dc:rights

• CC0 1.0 Universal

Licence dc:rights.uri

• http://creativecommons.org/publicdomain/zero/1.0/

Language dc:language.iso

en

Handle dc:identifier.uri

https://hdl.handle.net/10919/138146

OAI identifier oai:identifier

oai:vtechworks.lib.vt.edu:10919/138146