microsoft / microsoft/ebpf-for-windows

eBPF helpers do not fully initialize buffers

Open
#5,368 0 comments 0 reactions 1 assignee View on GitHub

@Alan-Jowett is already working on this.

Since Jun 15, 2026.

bug P2 triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

### Describe the bug

The PREVAIL verifier allows valid BPF code to access uninitialized stack memory in some edge cases.

Specifically, code that uses helper functions which take a pointer argument to a buffer and do not explicitly initialize the buffer on every code path cause the verifier to accept programs that are not valid.

A change in the documentation there will clarify the contract and mention that helpers need to initialize the full buffer range (see https://github.com/vbpf/prevail/pull/1146).

https://github.com/microsoft/ebpf-for-windows/blob/00053ce6b11b51186861b27853a20c6e1927b5fa/libs/execution_context/ebpf_core.c#L2657-L2708 contains functions that return early without initializing the buffer, thus triggering this exact problem.

These functions should explicitly initialize the buffers they operate on to avoid this issue.

### OS information

_No response_

### Steps taken to reproduce bug

Run any of the helper functions that have an early-return path without initializing the buffers they are supposed to operate on.
The verifier will flag such programs as correct.

### Expected behavior

Initialization should be guaranteed to avoid reading from uninitialized memory after calls to helper functions.

### Actual outcome

The verifier accepts the program and uninitialized memory reads are possible.

### Additional details

_No response_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.