Firefly: High-Performance Transient Execution Attack Defenses for In-Kernel Sandboxes

Gerhorst L, Herzog H, Herzog B, Wägemann P, Kapitza R, Hönig T (2026)

Publication Language: English

Publication Type: Conference contribution, Conference Contribution

Publication year: 2026

Event location: Lancaster, UK

Open Access Link: https://files.luisgerhorst.de/firefly.pdf

Abstract

Safe operating system kernel extensions, as implemented by Linux eBPF, enable improved application performance, kernel observability, and system security. To extend these benefits beyond privileged applications, the kernel must ensure that eBPF programs cannot escape their in-kernel sandbox through transient execution attacks, such as Spectre. However, all existing defenses for eBPF (i.e., upstream eBPF, VeriFence, BeeBox, and HIVE) lack at least one of three properties an in-kernel sandbox requires: (1) low overhead, (2) portability, and (3) address-space sharing. This raises the systems design question of whether in-kernel sandboxes must give up one of these properties to defend against transient execution attacks.

To answer this question, we present Firefly, a verifier-based defense for eBPF that simultaneously achieves these three properties through co-design of verifier logic, helper interfaces, and code generation. At its core is a speculation-aware verifier that unifies Spectre-PHT (v1) and Spectre-STL (v4) handling while using a refined constant-time leakage model that also protects physical-layout information. Unlike BeeBox and HIVE, Firefly does not require ARM64-specific hardware features, address-space separation, or driver-specific optimizations. On x64, Firefly matches the most performant, but use-case–specific, BeeBox variant, whereas generic state-of-the-art alternatives add 71% to 151% for Meta's Katran load balancer. Firefly, in contrast, only induces 6% to 26% eBPF execution-time overhead.

Authors with CRIS profile

Luis Gerhorst Lehrstuhl für Informatik 4 (Systemsoftware) Peter Wägemann Lehrstuhl für Informatik 4 (Systemsoftware) Rüdiger Kapitza Lehrstuhl für Informatik 4 (Systemsoftware)

Involved external institutions

Ruhr-Universität Bochum (RUB) DE Germany (DE)

How to cite

APA:

Gerhorst, L., Herzog, H., Herzog, B., Wägemann, P., Kapitza, R., & Hönig, T. (2026). Firefly: High-Performance Transient Execution Attack Defenses for In-Kernel Sandboxes. In Proceedings of the 29th International Symposium on Research in Attacks, Intrusions and Defenses (RAID'26). Lancaster, UK.

MLA:

Gerhorst, Luis, et al. "Firefly: High-Performance Transient Execution Attack Defenses for In-Kernel Sandboxes." Proceedings of the 29th International Symposium on Research in Attacks, Intrusions and Defenses (RAID'26), Lancaster, UK 2026.

BibTeX: Download