Hacker News

points by tclancy 1 day ago | 0 comments

Hang on, what are you getting at?

They ran it without a jailer, and exploited a bug in the linux socket code. Firecracker was just how they invoked/worked with /dev/kvm. It is not a firecracker bug. Its sensationalist nonsense.

[–] tptacek 1 day ago

It's very much a Firecracker thing. KVM is part of the Firecracker stack, and getting code execution behind the jailer is still effectively game-over; it's just a somewhat higher degree-of-difficulty game-over. It's a drastically worse place than you would have been last year, when there wasn't a known plausible way to get even that far.

This is a really good bug and nobody should downplay it.

[–] roughly 1 day ago

Huh, so the assertion here that this is a break past the KVM boundary broadly, then?

Also - re: the jailer, do you have more info on that being popped?

[–] tptacek 14 hours ago

The jailer is just a seccomp sandbox. It's not a novel defense system. Sandboxes get broken all the time.

[–] catlifeonmars 1 day ago

GP said

> They ran it without a jailer

And you said

> getting code execution behind the jailer is still effectively game-over

So I’m really confused, which is it?

[–] tptacek 1 day ago

Both, maybe? I mean: whether or not they broke the jailer, we know the jailer is breakable; it wouldn't really even be newsworthy to have an LPE that breaks the Firecracker jailer.

[–] stogot 1 day ago

Did they break the jailer? I thought from these comments they disabled it.

then the breach happens in KVM? Isn’t KVM its own software repo, and firecracker sits on top? How is this firecracker and not a KvM thing

[–] bulk88 20 hours ago

They C debugging APIs and root permissions in the Host OS to exploit a user mode process in the Host OS. Fire is hot. Water is wet.

[–] tptacek 12 hours ago

The jailer doesn't give you debugging APIs to work with. Jailed, if your original exploit only gives you RCE in Firecracker itself, you still need another LPE vulnerability to break the sandbox.

If they have arbitrary code execution in the Linux kernel itself (which it feels like maybe they should?) then the jailer is a nonfactor. But the exploit they write up sure seems like it's just getting code execution in userland from Firecracker itself.

[–] tclancy 1 day ago

I deeply love my idiot comment about not using password for your password generated useful stuff. Kudos to everyone here who rescued my idiocy. Now to change my luggage combination.

[–] tptacek 7 hours ago

It really is a great feeling; all my favorite HN threads (that I was involved in) are ones I kicked off with what I felt was a dumb question.

[–] zobzu 1 day ago

sounds like saying it's a Ubuntu thing because you can install firecracker and use kvm to me.

the truth is there plenty more kvm escapes that will be found.

[–] tptacek 12 hours ago

I'm sure there will be! They've been extremely rare to date, because KVM is itself a relatively simple piece of code, but everything's up for grabs now.