AI news ·
Researchers escape Firecracker microVM and achieve root code execution on the host
Security researchers achieved a full Firecracker microVM escape, executing arbitrary code as root on the host. The exploit hijacked the vCPU thread to force the Firecracker process to write a marker, proving control while the VM stayed live.
Security researchers have demonstrated a complete escape from a Firecracker microVM, achieving arbitrary code execution as root on the host machine. The exploit, detailed as CVE-2026-99999, chains together a host memory access primitive with a technique to locate and hijack the virtual CPU thread managing the guest, forcing the host process to execute attacker-chosen commands.
The attack targets the point where a Firecracker thread returns from the KVM kernel subsystem to userspace. By modifying the saved register frame of a live vCPU thread, the guest can redirect execution to a chosen function within the Firecracker process. The proof of concept forced the process to write a specific marker to its standard error output, confirming control while leaving the VM fully operational and accessible over SSH.
How the escape chain works
The exploit builds on a previously established ability to read and write selected regions of host physical memory from inside the guest. The challenge was turning that raw access into control of a specific process. The researchers solved this in four stages.
First, they placed a recognizable byte pattern in a guest page and searched host memory for the Extended Page Table (EPT) entries that translated the guest physical address to its host physical address. This connected a known guest page to its physical backing on the host.
Second, they worked backward from that physical page to find the host process mapping it. By reverse-mapping the host's native page tables, they recovered the page global directory (PGD) for the Firecracker process. This let them read the process's code and data through their memory primitive, identify the Firecracker executable despite address space layout randomization (ASLR), and calculate the runtime addresses of specific functions.
Finding and redirecting the live thread
With the process mapped, the third stage located the saved register frame for the vCPU thread running their VM. A thread inside a KVM_RUN system call has a predictable instruction pointer pointing to the ioctl continuation inside Firecracker. The researchers searched host memory for a frame matching that address plus a set of additional constraints: the system call identity, the KVM_RUN request code, a valid file descriptor range, stack pointer consistency with the recovered PGD, and correct segment selectors.
The search returned a single candidate. Before modifying it, the final helper re-validated the code signatures, register state, and stack geometry to confirm the frame was live and belonged to the expected process.
The payload redirected the return from KVM_RUN to Firecracker's own write wrapper, passing stderr as the file descriptor and a marker string placed on the process's private stack. A short return sequence cleared the return value register and resumed execution at the original ioctl continuation. A single byte written to the guest's serial port triggered the exit from KVM, and the modified registers took effect immediately.
Verification and recovery
The host captured Firecracker's stderr separately. It contained exactly the eight-byte marker "N8V23M2" followed by a newline. The Firecracker process remained alive with the same PID, the guest SSH session stayed responsive, and the exploit restored the three modified stack words to their original values.
A subsequent dry-run validation pass confirmed that all register invariants, code signatures, and stack contents were intact. No host kernel errors were observed, and the executable text and shared libraries showed no modification.
Why this matters for insurance, IT, and operations professionals
Firecracker is the virtualization technology underpinning AWS Lambda and Fargate. Its design goal is to isolate untrusted customer workloads in lightweight microVMs. This escape demonstrates that a memory access primitive inside the guest can be escalated to host code execution with the privileges of the Firecracker process-in this configuration, root.
Production deployments add containment layers including user namespace isolation and seccomp filters that restrict available system calls. Those controls were not active in this test setup, so a separate assessment is required for jailed configurations. The core discovery remains significant: the chain from guest memory access to host thread control is deterministic, repeatable, and does not depend on rare race conditions or kernel bugs. For teams managing multi-tenant compute environments, this work provides a concrete reference for understanding the blast radius of a VMM compromise and the importance of defense-in-depth beyond the virtualization boundary.