The extended Berkeley Packet Filter (eBPF) framework has revolutionized the way developers interact with the Linux kernel by enabling safe, dynamic programmability. However, this flexibility comes at a cost. The new kernel functions (kfuncs) exposed to eBPF programs are rapidly proliferating, often without adequate testing. While prior work has addressed verifier and helper function fuzzing, the kfuncs remain a largely unexplored attack surface. This thesis presents EKFuzz, a Syzkaller-based fuzzing extension that systematically targets kfuncs used by eBPF programs. EKFuzz incorporates type-aware generation of verifier-compliant programs, automatically generates dependent syscalls (e.g., for maps), and employs a mutation-driven feedback loop. Our evaluation demonstrates that EKFuzz achieves deeper runtime coverage than Syzkaller and uncovers latent bugs within the kfunc execution paths.

Modern operating systems must balance safety and performance. Linux introduced eBPF to safely run custom programs inside the kernel-making tools for networking, monitoring, and security more efficient. To help eBPF programs interact with the kernel, developers expose internal kernel functions (called kfuncs). However, these functions are growing rapidly in number and are often not thoroughly tested. This thesis presents a testing tool, EKFuzz, which can automatically try many different inputs and combinations to catch potential problems in these functions. EKFuzz builds on an existing testing tool called Syzkaller and improves it to better handle this new type of kernel interaction. The result is a safer, more robust Linux system.

This thesis work is supported by the Defense Advanced Research Projects Agency (DARPA) and Naval Information Warfare Center Pacific (NIWC Pacific) under Contract No. N66001-21-C-4028 and the US National Science Foundation (NSF) under grant CNS-2234257.

Master of Science