Comment by sscaryterry
18 hours ago
> This is an issue in the kernel networking stack.
Exactly, its not a firecracker issue. Using firecracker without a jailer is like setting your password to "password".
18 hours ago
> This is an issue in the kernel networking stack.
Exactly, its not a firecracker issue. Using firecracker without a jailer is like setting your password to "password".
Hang on, what are you getting at?
They ran it without a jailer, and exploited a bug in the linux socket code. Firecracker was just how they invoked/worked with /dev/kvm. It is not a firecracker bug. Its sensationalist nonsense.
It's very much a Firecracker thing. KVM is part of the Firecracker stack, and getting code execution behind the jailer is still effectively game-over; it's just a somewhat higher degree-of-difficulty game-over. It's a drastically worse place than you would have been last year, when there wasn't a known plausible way to get even that far.
This is a really good bug and nobody should downplay it.
9 replies →