# How eBPF Could Prevent Kernel Crashes from Security Software Updates

DevFeed: [How eBPF Could Prevent Kernel Crashes from Security Software Updates](<https://devfeed.tech/articles/no-more-blue-fridays-13601.md>)

Original publisher: [Read original article](<http://www.brendangregg.com/blog//2024-07-22/no-more-blue-fridays.html>)

Published: 2024-07-21T14:00:00Z

Content type: opinion

Language: en

Sources: [Brendan Gregg's Blog](<https://devfeed.tech/sources/brendan-gregg-s-blog.md>)

Topics: [eBPF](<https://devfeed.tech/topics/ebpf.md>), [Security](<https://devfeed.tech/topics/security.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [browsers](<https://devfeed.tech/topics/browsers.md>)

Tags: [blog](<https://devfeed.tech/tags/blog.md>), [browsers](<https://devfeed.tech/tags/browsers.md>), [ebpf](<https://devfeed.tech/tags/ebpf.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [linux](<https://devfeed.tech/tags/linux.md>), [outage](<https://devfeed.tech/tags/outage.md>), [outages](<https://devfeed.tech/tags/outages.md>), [security](<https://devfeed.tech/tags/security.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

This opinion article examines a major Windows outage caused by a security software configuration update that made a kernel driver read invalid memory. It argues that eBPF's verifier and sandboxed execution model could reduce the risk of kernel crashes, including for Windows once Microsoft's eBPF support is production-ready.

## Source excerpt

In the future, computers will not crash due to bad software updates, even those updates that involve kernel code. In the future, these updates will push eBPF code. Friday July 19th provided an unprecedented example of the inherent dangers of kernel programming, and has been called the largest outage in the history of information technology. Windows computers around the world encountered blue-screens-of-death and boot loops, causing outages for hospitals, airlines, banks, grocery stores, media broadcasters, and more. This was caused by a config update by a security company for their widely used product that included a kernel driver on Windows systems. The update caused the kernel driver to try to read invalid memory, an error type that will crash the kernel. For Linux systems, the company behind this outage was already in the process of adopting eBPF, which is immune to such crashes. Once Microsoft's eBPF support for Windows becomes production-ready, Windows security software can be ported to eBPF as well. These security agents will then be safe and unable to cause a Windows kernel crash. eBPF (no longer an acronym) is a secure kernel execution environment, similar to the secure JavaScript runtime built into web browsers. If you're using Linux, you likely already have eBPF available on your systems whether you know it or not, as it was included in the kernel several years ago. eBPF programs cannot crash the entire system because they are safety-checked by a software verifier and are effectively run in a sandbox. If the verifier finds any unsafe code, the program is rejected and not executed. The verifier is rigorous -- the Linux implementation has over 20,000 lines of code -- with contributions from industry (e.g., Meta, Isovalent, Google) and academia (e.g., Rutgers University, University of Washington). The safety this provides is a key benefit of eBPF, along with heightened security and lower resource usage. Some eBPF-based security startups (e.g., Oligo, Uptycs)