Firecracker VM Escape: PwnEscape Part 2

lrvick

I am more convinced by the day that the Nova Microhypervisor approach is correct. Do virtualization with a tiny formally verified microkernel and have complex kernels like Linux run underneath instead of letting a huge, complex, and brittle linux kernel and vm ecosystem control the hypervisor layer. https://hypervisor.org/

aghadge

it's really informative. At least someone are break it.

thisisauserid

Firecracker VMs run on AWS. Odd that the article doesn't mention that.

sscaryterry

This is pure LLM slop.

markasoftware

This is not a new vulnerability, it's just a description of how to exploit the PwnEscape vulnerability in practice on firecracker VMs (disclosed multiple weeks ago and discussed in some less upvoted posts on HN)

zX41ZdbW

I have a demo service that entirely relies on Firecracker VMs: ClickBench playground, https://benchmark.clickhouse.com/playground/ It hosts hundreds of database engines - many of them have vulnerabilities, and some of them, like Pandas, are basically open RCEs regardless. We can PoC the Firecracker VM Escape on that service.

denysvitali

Dupe: https://news.ycombinator.com/item?id=50381397 (Doesn't HN usually deduplicate links? I'm confused)

Betelbuddy

https://aws.amazon.com/security/security-bulletins/2026-137-...

clhodapp

I posted a similar query on the Replit sandbox engine article, but.. How do people feel about the hardware isolation provided by microVMs versus the stronger end of software isolation techniques like gvisor? Right now, we put a huge amount of stock in "hardware isolation". If that starts falling to agents to any substantial degree, I wonder whether we might end up leaning more on patchable software isolation, similar to the rise of software RAID (though, in userspace this time).

scoodah

I really wish they would have expanded on this paragraph in their article further: > The configuration used here had no jailer. Firecracker's production containment includes dropping privileges and restricting the process through namespaces and seccomp. A deployment using those controls requires a separate assessment of the privileges and resources available after compromising its VMM. If I'm understanding all of this correctly, a properly jailed and configured firecracker instance would greatly reduce the blast radius of this escape, and I feel as though it would have been good for them to explain what jailing and dropping privileges would do to help. I'd hope most production firecracker deployments would be doing this already. Not saying that this is any less severe and the root issue is not specific to Firecracker, but to a flaw in the kernel's network code -- they just used an insecure firecracker configuration to demonstrate it. However, I feel like some are taking this as a flaw with firecracker when its not. This is an issue in the kernel networking stack.

nwilkens

I've been building Firehyve, which is a firecracker like microVM solution for illumos and FreeBSD.. https://github.com/TritonDataCenter/rshyve Running our microVM's inside of a jailed zone, at least gives me some peace of mind.. It's far from perfect, as a zone escape could be lurking.. but at least it's a layer of defense.