Comment by sscaryterry
16 hours ago
They ran it without a jailer, and exploited a bug in the linux socket code. Firecracker was just how they invoked/worked with /dev/kvm. It is not a firecracker bug. Its sensationalist nonsense.
16 hours ago
They ran it without a jailer, and exploited a bug in the linux socket code. Firecracker was just how they invoked/worked with /dev/kvm. It is not a firecracker bug. Its sensationalist nonsense.
It's very much a Firecracker thing. KVM is part of the Firecracker stack, and getting code execution behind the jailer is still effectively game-over; it's just a somewhat higher degree-of-difficulty game-over. It's a drastically worse place than you would have been last year, when there wasn't a known plausible way to get even that far.
This is a really good bug and nobody should downplay it.
Huh, so the assertion here that this is a break past the KVM boundary broadly, then?
Also - re: the jailer, do you have more info on that being popped?
The jailer is just a seccomp sandbox. It's not a novel defense system. Sandboxes get broken all the time.
GP said
> They ran it without a jailer
And you said
> getting code execution behind the jailer is still effectively game-over
So I’m really confused, which is it?
Both, maybe? I mean: whether or not they broke the jailer, we know the jailer is breakable; it wouldn't really even be newsworthy to have an LPE that breaks the Firecracker jailer.
3 replies →
[flagged]
sounds like saying it's a Ubuntu thing because you can install firecracker and use kvm to me.
the truth is there plenty more kvm escapes that will be found.