microsoft / microsoft/ebpf-for-windows
eBPF helpers do not fully initialize buffers
@Alan-Jowett is already working on this.
Since Jun 15, 2026.
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
### Describe the bug
The PREVAIL verifier allows valid BPF code to access uninitialized stack memory in some edge cases.
Specifically, code that uses helper functions which take a pointer argument to a buffer and do not explicitly initialize the buffer on every code path cause the verifier to accept programs that are not valid.
A change in the documentation there will clarify the contract and mention that helpers need to initialize the full buffer range (see https://github.com/vbpf/prevail/pull/1146).
https://github.com/microsoft/ebpf-for-windows/blob/00053ce6b11b51186861b27853a20c6e1927b5fa/libs/execution_context/ebpf_core.c#L2657-L2708 contains functions that return early without initializing the buffer, thus triggering this exact problem.
These functions should explicitly initialize the buffers they operate on to avoid this issue.
### OS information
_No response_
### Steps taken to reproduce bug
Run any of the helper functions that have an early-return path without initializing the buffers they are supposed to operate on.
The verifier will flag such programs as correct.
### Expected behavior
Initialization should be guaranteed to avoid reading from uninitialized memory after calls to helper functions.
### Actual outcome
The verifier accepts the program and uninitialized memory reads are possible.
### Additional details
_No response_
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.