Comment by tptacek
17 hours ago
Just for what it's worth, that escape is much more situational than PwnEscape (there have been other escapes that depended on nested KVM, as well). Pretty much everyone seems to have been exposed with PwnEscape, because everyone using Firecracker is also using virtio-net.
I actually do use Firecracker without a network adapter, though vsock/virtio could have remaining issues
[dead]