Firecracker VM Escape: Security Researchers Achieve Host Code Execution

Researchers have successfully demonstrated a breakout from the isolated Firecracker microVM environment, achieving arbitrary code execution with root privileges on the host machine. This work continues the PwnEscape series and highlights sophisticated low-level interactions within virtualized environments.

• Researchers leveraged a guest-to-host memory access primitive developed in earlier research.
• The attack locates the Firecracker process in memory to hijack an active vCPU thread from inside the guest.
• Modifications are applied to the pt_regs structure where the host kernel preserves user-space registers during system calls.

Firecracker Architecture and Threat Model

A Firecracker microVM is managed by a dedicated host process. Each virtual CPU runs a thread that enters KVM to execute guest code and returns to userspace when events require handling. While the thread executes this system call, the host kernel saves its userspace registers in a structure called pt_regs.

The instruction pointer and stack pointer define the execution context of the thread. Researchers targeted the return path from KVM_RUN, realizing that locating and modifying this saved frame allows them to dictate what code Firecracker executes when the thread returns to userspace.

Memory Exploration and EPT Resolution

Guests and hosts utilize distinct physical address spaces. By placing a recognizable byte pattern (nonce) inside a guest page, researchers mapped guest physical addresses to host physical addresses by walking Extended Page Tables (EPT) root structures.

A reverse mapper searched native host page tables to identify the process mapping that specific physical page, recovering the page table root (PGD) and the load bias of the Firecracker binary. This bypassed Address Space Layout Randomization (ASLR) and enabled precise inspection of the running process image.

Thread Hijacking and Execution

The final stage involved locating the pt_regs frame belonging to the active vCPU thread. By leveraging the known return address from KVM_RUN and validating stack parameters, researchers isolated the exact host physical address of the saved register frame.

Modifying this frame redirected the execution flow as the thread transitioned from the kernel back to the Firecracker userspace. This resulted in successful payload execution on the host while keeping the guest virtual machine accessible over SSH.

What This Means for Developers and Businesses

Advanced breakout techniques like this underline the critical importance of robust isolation in multi-tenant cloud environments. While cloud infrastructure providers continuously patch hypervisor components, understanding these low-level memory mechanics remains essential for maintaining secure virtualization setups.