I really wish they would have expanded on this paragraph in their article further:<p>> The configuration used here had no jailer. Firecracker's production containment includes dropping privileges and restricting the process through namespaces and seccomp. A deployment using those controls requires a separate assessment of the privileges and resources available after compromising its VMM.<p>If I'm understanding all of this correctly, a properly jailed and configured firecracker instance would greatly reduce the blast radius of this escape, and I feel as though it would have been good for them to explain what jailing and dropping privileges would do to help. I'd hope most production firecracker deployments would be doing this already.<p>Not saying that this is any less severe and the root issue is not specific to Firecracker, but to a flaw in the kernel's network code -- they just used an insecure firecracker configuration to demonstrate it. However, I feel like some are taking this as a flaw with firecracker when its not. This is an issue in the kernel networking stack.
That's a good catch. Yes, since they've only proven this up to the jailer boundary, you'd need a second and relatively powerful LPE vulnerability to get real host control out of this.
Thanks to frontier reasoning agents, Linux is completely riddled in ways you can discover 900+ LPE vulnerabilities. [0]<p>Another wave of vulnerabilities like this are yet to be discovered in Linux. We are just seeing how weak C and C++ based OSes and kernels are when put under hundreds of AI agents.<p>[0] <a href="https://openai.com/index/a-thousand-fewer-paths-to-root/" rel="nofollow">https://openai.com/index/a-thousand-fewer-paths-to-root/</a>
Watch Hartman’s response to the first wave of issues found by AI. Super dismissive and ignorant.<p>I’m not sure the people that caused this will be the one fixing it.
And how many of these vulns are in code for legacy hardware or filesystem support that in no way reflects threats against modern Linux installs? I wager the overwhelming majority of them.
We always knew this, it has been understood since nearly the dawn of the monokernel OS that there is always a route to privilege escalation somewhere. This is why even for web applications that would be better served by a shell, people choose CGI-style interfaces instead.<p>The only reason it wasn't seen as a problem was due to the effort and time it took to find and exploit them.
> This is an issue in the kernel networking stack.<p>Exactly, its not a firecracker issue. Using firecracker without a jailer is like setting your password to "password".
Nope. The exploit compromises the host kernel. The researchers built an unconventional exploit chain in which they used the host kernel compromise to compromise the host firecracker userspace code, but I see no fundamental reason they couldn't have compromised something else in the host kernel.
Wait, this is also presumably true, come to think of it. I'm a little fuzzy because they document the memory disclosure primitive carefully but not the memory writes they also got from it --- but whatever those are, they're hitting kernel memory? But the exploit they're describing here gets code execution out of Firecracker itself, not the kernel.
AIUI they’ve chosen as their target the host userspace pt_regs, i.e. the kernel structure that stores Firecracker’s register state. If they can find it and write to it, they can control the complete register state of Firecracker.<p>I assume they chose it as their target because Firecracker, like most Linux KVM userspace [0], maps guest memory into its own address space, giving an easy place to write gadgets.<p>My personal favorite thing to poke into pt_regs is an actual privileged (CPL0) context. [1] Returning from the kernel right back to a controlled kernel context is allowed by the CPU :)<p>[0] Until fairly recently this was mandatory. These days it’s possible to ask KVM to map something into the guest without having it in host userspace memory.<p>[1] Corrupt pt_regs so it executes user memory in kernel mode:<p><a href="https://seclists.org/oss-sec/2015/q3/291" rel="nofollow">https://seclists.org/oss-sec/2015/q3/291</a><p>I think this may be my favorite of all exploits I’ve ever written. In fact, I often made a point of <i>not</i> writing interesting exploits for corruption bugs I found, but this one was too much fun to pass up.
Yeah, they're not saying a lot there. And then the proof of concept code is just being passed the physical addresses of the pages they talk about as command line args, and is just opening /dev/mem to do brain surgery on them.<p>Which like, isn't really a proof of concept of anything being described.<p>"That was always allowed".
yup, the other firecracker escape recently (<a href="https://www.coinspect.com/blog/firecracker-escape/" rel="nofollow">https://www.coinspect.com/blog/firecracker-escape/</a>) popped the jailer via io_uring (tl;dr firecracker was filtering syscalls appropriately with seccomp, and was filtering the uring _they_ initiated, so attacker just got them to pop a new unfiltered uring, which is rather nice).
Just for what it's worth, that escape is much more situational than PwnEscape (there have been other escapes that depended on nested KVM, as well). Pretty much everyone seems to have been exposed with PwnEscape, because everyone using Firecracker is also using virtio-net.
I am more convinced by the day that the Nova Microhypervisor approach is correct.<p>Do virtualization with a tiny formally verified microkernel and have complex kernels like Linux run underneath instead of letting a huge, complex, and brittle linux kernel and vm ecosystem control the hypervisor layer.<p><a href="https://hypervisor.org/" rel="nofollow">https://hypervisor.org/</a>
How is this different from Xen? It's the same approach as Xen or Hyper-V where the hypervisor is its own component, then you boot into a virtualized Dom0 or Root Partition (in Xen and Hyper-V terminology respectively) that can manage the hypervisor underneath it.<p>This is different from KVM where your hypervisor runs in your Dom0/Root Partition.
Xen had a generic guest to host vulnerability disclosed in the last few days: <a href="https://codeant.ai/security-research/xenbleed-a-grant-copy-cache-bug-that-reaches-dom0-memory">https://codeant.ai/security-research/xenbleed-a-grant-copy-c...</a>
Yeah, all security design guarantees are as good as the implementation at the end of the day. All the fancy hashing and encryption math in the world isn't gonna save you from an erroneous `"<i>" == "</i>"` check or an invalid reference check.<p>I was replying to OP saying it's the same "approach" as Xen, if your preference is "approach" based. It's fair though to point to Nova's smaller code base. It's becoming an important metric for me in general (how big is the code base). It's not a bullet proof thing, but having a smaller code base is a positive sign in 2026 for me.
having worked with AWS, xen had a lot of very bad vulns over its lifetime as well.<p>there's no magic.
Now compare to Linux, which is the point raised. Nobody said alternatives like Xen are perfect... but my oh my, some are much better in this regard.
This is a much lighter weight (~100k) alternative to Xen focused on baremetal TPM anchored remote attestation, formal verification, and trusted computing applications.<p>Anyone considering Xen should probably also consider Nova depending on requirements.
Isn't VMware also that design ?
Xen is formally verified?
I don't know much of anything about Nova but since the late 1990s this has also been the pitch for L4; there are several mature L4's.
> the Nova Microhypevisor approach is correct<p>To save people the time:<p><i>"This code is experimental and not feature complete. If it breaks, you get to keep both pieces."</i>
I have a demo service that entirely relies on Firecracker VMs: ClickBench playground, <a href="https://benchmark.clickhouse.com/playground/" rel="nofollow">https://benchmark.clickhouse.com/playground/</a><p>It hosts hundreds of database engines - many of them have vulnerabilities, and some of them, like Pandas, are basically open RCEs regardless.<p>We can PoC the Firecracker VM Escape on that service.
<p><pre><code> > "run SQL against 110+ databases"
</code></pre>
This is one of the most useful web tools I've ever seen.<p>I work on connectors for datasources (mostly DB's. Being able to quickly test things like sorting behavior and how the same function can be emulated across DB's would have made my life so much easier.
> We can PoC the Firecracker VM Escape on that service.<p>Does this mean you ran the exploit on your service and confirmed it worked? If so, why would you be advertising this, lol. Unless you've already patched?
This is not a new vulnerability, it's just a description of how to exploit the PwnEscape vulnerability in practice on firecracker VMs (disclosed multiple weeks ago and discussed in some less upvoted posts on HN)
Dupe: <a href="https://news.ycombinator.com/item?id=50381397">https://news.ycombinator.com/item?id=50381397</a><p>(Doesn't HN usually deduplicate links? I'm confused)
I posted a similar query on the Replit sandbox engine article, but..<p>How do people feel about the hardware isolation provided by microVMs versus the stronger end of software isolation techniques like gvisor?<p>Right now, we put a huge amount of stock in "hardware isolation". If that starts falling to agents to any substantial degree, I wonder whether we might end up leaning more on patchable software isolation, similar to the rise of software RAID (though, in userspace this time).
My intuition is that gVisor is never going to be stronger in a fair comparison. Almost all the vulns are in I/O code and every type of container/VM/sandbox has I/O.
FYI, gvisor also uses KVM under the hood; it's not completely orthogonal to [micro]VMs.
You mean virtualised hardware ? That's still technically software
I've been building Firehyve, which is a firecracker like microVM solution for illumos and FreeBSD.. <a href="https://github.com/TritonDataCenter/rshyve" rel="nofollow">https://github.com/TritonDataCenter/rshyve</a><p>Running our microVM's inside of a jailed zone, at least gives me some peace of mind.. It's far from perfect, as a zone escape could be lurking.. but at least it's a layer of defense.
As another commenter noted, the PoC in this article doesn't defeat the Firecracker jailer, which does essentially what a "zone" would do for you. In both cases, that's cold comfort, because even in an unprivileged sandbox environment you still have a huge kernel attack surface to contend with LPEs in.
Security Exploit requires layering with a Sys Admin Permission Exploit. Nuff said.<p>This so-called Firecracker exploit never explained how the Guest was able to write to the Host OS's Firecracker user mode process. If the write controlled by the guest to the host was that TCP/IP routing stack Exploit in the host OS's Linux kernel, this Firecracker Exploit is meaningless. The Guest already has unlimited control over the host OS.<p>I (and anyone) can do this exploit in 2-3 minutes using GDB or Visual Studio's C debugger tool. Freeze process, type new pointers into CPU context snap shot, click resume, Exploit done.
<a href="https://aws.amazon.com/security/security-bulletins/2026-137-aws/" rel="nofollow">https://aws.amazon.com/security/security-bulletins/2026-137-...</a>
[flagged]
Firecracker VMs run on AWS. Odd that the article doesn't mention that.
Firecracker is open source and possibly others use it, AWS sells services with it though.
(A more complete way to say this is that Firecracker is the engine built to run AWS Lambda and AWS Fargate).
It has notable adoption in the agent sandbox space where this type of vulnerability is especially volatile.
> The target was Firecracker v1.16.1 on x86-64, with host kernel 7.0.0-1011-aws.
Fly uses it too afaik
[dead]
Not affected
<a href="https://aws.amazon.com/security/security-bulletins/2026-137-aws/" rel="nofollow">https://aws.amazon.com/security/security-bulletins/2026-137-...</a>
The article is light on details, it is LLM slop.
it's really informative. At least someone are break it.
This is pure LLM slop.
You need something more interesting to say than this, because this is an article by the discoverers of this vulnerability, the first general-purpose Firecracker escape that doesn't depend on nested virtualization in recent memory, along with in-depth discussion of exploitability. It's inherently interesting and on-topic and there isn't an alternate source for the same content.