Repository navigation
Avoid panics on unimplemented instructions (e.g., ST_W_XADD) #135
Description
Hello! Thanks for your work on this project. I encountered a potential DoS issue during testing.
Description
The rbpf verifier (src/verifier.rs) explicitly panics via unimplemented!() when encountering certain eBPF opcodes (e.g., ST_W_XADD, ST_DW_XADD, TAIL_CALL).
If an application loads an eBPF program containing these instructions using EbpfVmMbuff::new(), the entire host process will crash, leading to a Denial of Service (DoS).
Crash Location
src/verifier.rs:157-match ebpf::ST_W_XADDsrc/verifier.rs:158-match ebpf::ST_DW_XADDsrc/verifier.rs:278-match ebpf::TAIL_CALL
Error Message
thread 'main' panicked at /mnt/e/A_IT/rust_library/rbpf-main/src/verifier.rs:157:35:
not implemented
Reproduction Code
Here is a minimal reproduction script using EbpfVmMbuff::new directly.
Cargo.toml dependencies:
[dependencies]
rbpf = "0.2" # or current versionmain.rs:
use std::env;
use std::fs::File;
use std::io::Read;
use rbpf::EbpfVmMbuff; // Ensure rbpf is in your dependencies
fn main() {
let args: Vec<String> = env::args().collect();
if args.len() < 2 {
eprintln!("Usage: cargo run -- <poc_file>");
return;
}
let filename = &args[1];
let mut file = File::open(filename).expect("Failed to open file");
let mut prog = Vec::new();
file.read_to_end(&mut prog).expect("Failed to read file");
println!("Attempting to load eBPF program from: {}", filename);
// This call triggers the panic in the verifier
match EbpfVmMbuff::new(Some(&prog)) {
Ok(_) => println!("Program loaded successfully."),
Err(e) => println!("Error loading program: {}", e),
}
}POC
[poc_st_w_xadd.bin] (Opcode 0xC3)
[poc_st_dw_xadd.bin] (Opcode 0xDB)
[poc_tail_call.bin] (Opcode 0x8D)
Stack Trace (Example using ST_W_XADD)
thread 'main' (18542) panicked at /mnt/e/A_IT/rust_library/rbpf-main/src/verifier.rs:157:35:
not implemented
stack backtrace:
0: __rustc::rust_begin_unwind
at /rustc/b68e16cfc0e9f8b29c9ec41bfa6ab0a637eff19c/library/std/src/panicking.rs:689:5
1: core::panicking::panic_fmt
at /rustc/b68e16cfc0e9f8b29c9ec41bfa6ab0a637eff19c/library/core/src/panicking.rs:80:14
2: core::panicking::panic
at /rustc/b68e16cfc0e9f8b29c9ec41bfa6ab0a637eff19c/library/core/src/panicking.rs:150:5
3: rbpf::verifier::check
at /mnt/e/A_IT/rust_library/rbpf-main/src/verifier.rs:157:35
4: <rbpf::EbpfVmMbuff>::new
at /mnt/e/A_IT/rust_library/rbpf-main/src/lib.rs:209:13
5: reproduce_issue::main
at ./issue/reproduce_issue.rs:24:15
6: <fn() as core::ops::function::FnOnce<()>>::call_once
at /home/num1/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5
Activity
[-]DoS in `rbpf` verifier due to panic on unimplemented instructions (e.g., ST_W_XADD)[/-][+]Avoid panics on unimplemented instructions (e.g., ST_W_XADD)[/+]qmonnet commentedon Jan 14, 2026
Thanks, yes I never implemented these. The panics should be easy enough to address by rejecting the program with an error when encountering these instructions, though. Would you be interested in contributing a Pull Request, by any chance?
Echo8377 commentedon Jan 14, 2026
Hi, I just submitted PR #137 to address this. I updated the code to reject the program with an error instead of panicking. Please take a look when you have time.
qmonnet commentedon Jan 15, 2026
Addressed with #137. Thanks!