Hacker News

points by sscaryterry 1 day ago | 0 comments

> This is an issue in the kernel networking stack.

Exactly, its not a firecracker issue. Using firecracker without a jailer is like setting your password to "password".

Hang on, what are you getting at?

They ran it without a jailer, and exploited a bug in the linux socket code. Firecracker was just how they invoked/worked with /dev/kvm. It is not a firecracker bug. Its sensationalist nonsense.

[–] tptacek 1 day ago

It's very much a Firecracker thing. KVM is part of the Firecracker stack, and getting code execution behind the jailer is still effectively game-over; it's just a somewhat higher degree-of-difficulty game-over. It's a drastically worse place than you would have been last year, when there wasn't a known plausible way to get even that far.

This is a really good bug and nobody should downplay it.

[–] roughly 1 day ago

Huh, so the assertion here that this is a break past the KVM boundary broadly, then?

Also - re: the jailer, do you have more info on that being popped?

[–] tptacek 14 hours ago

The jailer is just a seccomp sandbox. It's not a novel defense system. Sandboxes get broken all the time.

[–] catlifeonmars 1 day ago

GP said

> They ran it without a jailer

And you said

> getting code execution behind the jailer is still effectively game-over

So I’m really confused, which is it?

[–] tptacek 1 day ago

Both, maybe? I mean: whether or not they broke the jailer, we know the jailer is breakable; it wouldn't really even be newsworthy to have an LPE that breaks the Firecracker jailer.

[–] stogot 1 day ago

Did they break the jailer? I thought from these comments they disabled it.

then the breach happens in KVM? Isn’t KVM its own software repo, and firecracker sits on top? How is this firecracker and not a KvM thing

[–] bulk88 20 hours ago

They C debugging APIs and root permissions in the Host OS to exploit a user mode process in the Host OS. Fire is hot. Water is wet.

[–] tclancy 1 day ago

I deeply love my idiot comment about not using password for your password generated useful stuff. Kudos to everyone here who rescued my idiocy. Now to change my luggage combination.

[–] tptacek 7 hours ago

It really is a great feeling; all my favorite HN threads (that I was involved in) are ones I kicked off with what I felt was a dumb question.

[–] zobzu 1 day ago

sounds like saying it's a Ubuntu thing because you can install firecracker and use kvm to me.

the truth is there plenty more kvm escapes that will be found.

[–] tptacek 12 hours ago

I'm sure there will be! They've been extremely rare to date, because KVM is itself a relatively simple piece of code, but everything's up for grabs now.