Linux Kernel Crypto API Integration

4 posts · May 2015 – May 2026

What this trail covers

Cloudflare's Linux kernel infrastructure security has evolved to include robust processes for responding to vulnerabilities like 'Copy Fail' (CVE-2026-31431). This involves rapid assessment, validation of existing behavioral detections, proactive threat hunting, and the engineering of runtime mitigations (e.g., bpf-lsm) and kernel patches. The company leverages a standardized monthly Edge Reboot Release (ERR) cycle for edge infrastructure and a more flexible approach for control plane updates, ensuring timely deployment of security fixes without impacting production services or customer data. The process emphasizes a secure-by-design approach, with a focus on minimizing the attack surface and ensuring fleet-wide resilience.

All Cloudflare trails

May 2026How Cloudflare responded to the “Copy Fail” Linux vulnerabilityThis post details Cloudflare's response to the 'Copy Fail' Linux kernel vulnerability (CVE-2026-31431). It explains the vulnerability's mechanism involving the AF_ALG socket family, splice() system call, and page cache manipulation for out-of-bounds writes. Cloudflare's response included validating existing behavioral detections, performing fleet-wide threat hunting for exploitation signs, and engineering a bpf-lsm mitigation program. The company also detailed its standard Linux kernel release process (ERR pipeline) and how it ensures timely patching of LTS versions. The post highlights that no customer impact occurred due to preparedness and existing security measures.
May 2023The Linux Crypto API for user applicationsThis post explores the Linux Kernel Crypto API for user applications, detailing its architecture, pros and cons, and performance implications compared to user-space libraries like OpenSSL. It demonstrates how to use the API for AES-CTR-128 encryption via system calls and zero-copy interfaces, highlighting the performance benefits of hardware-accelerated crypto instructions (AES-NI) and the trade-offs between kernel-space and user-space cryptography.
Nov 2022The Linux Kernel Key Retention Service and why you should use it in your next applicationThis post introduces the Linux Kernel Key Retention Service as a mechanism to protect cryptographic keys from memory access violations. It explains how the service operates by storing keys in kernel space, isolated from user-space processes, and provides an interface via system calls for allowed applications to perform cryptographic operations. The post details the key and keyring entities, special keyrings (process and user), and the asymmetric key type for holding private keys. It highlights the advantages of using the kernel service over traditional agent processes, such as reduced development overhead and enforced ACLs.
May 2019eBPF can't count?!This post details a bug in the eBPF verifier that incorrectly rewrites 64-bit subtractions when running as an unprivileged user, leading to incorrect results. The bug was introduced as a mitigation for CVE-2019-7308 (Spectre variant 1). The post explores workarounds using 32-bit ALU operations and LLVM IR manipulation to achieve correct 64-bit subtraction in eBPF programs. It also highlights the importance of the Linux kernel's eBPF verifier in ensuring program safety and the impact of security fixes on existing functionality.
May 2015Go crypto: bridging the performance gapThis post details Cloudflare's creation of assembly implementations for AES-GCM and P256 Elliptic Curves in Go, aiming to bridge the performance gap with libraries like OpenSSL. It highlights the significant speedups achieved (e.g., 23.4X for AES-128-GCM) and explains the technical details of AES-GCM as an AEAD. The post also mentions improvements to Go's RSA implementation and the availability of a special Go fork with these enhancements.
Advertisement