Firecracker VM Escape: PwnEscape Part 2

Firecracker, a virtual machine monitor, is designed to keep untrusted code contained within a microVM. However, researchers demonstrated how to escape this containment and achieve code execution as root on the host system. The team identified the process managing the Firecracker microVM on the host and the threads within that process representing each virtual CPU (vCPU).

These threads enter KVM to execute the guest operating system and return to Firecracker for handling events in userspace. The team discovered that the return from KVM_RUN provided an opportune moment to influence the code Firecracker would execute upon the thread's return to userspace. By manipulating the saved register frame, the researchers could redirect the thread's execution flow.

They utilized a guest mapping to access selected host physical memory, identifying the Firecracker process and locating the saved registers for a vCPU thread. By placing a unique byte pattern, or nonce, within a guest page, the team could translate this page's guest physical address (GPA) to its host physical address (HPA) using Extended Page Tables (EPT).

This process allowed them to pinpoint the Firecracker executable within the host's memory space and verify its presence through a known byte sequence in Firecracker's write(2) wrapper. With the Firecracker image identified, the researchers could locate the necessary code within the running process by comparing the expected bytes with those present in the host memory.

The final step involved obtaining the saved registers of the vCPU thread currently executing within the VM. By combining this information with the Firecracker executable's location and the host's page tables, the researchers could construct a return path, effectively hijacking a live thread and taking control of the Firecracker process on the host.