Hacker News
points by stogot 1 day ago | 0 comments
Did they break the jailer? I thought from these comments they disabled it.

then the breach happens in KVM? Isn’t KVM its own software repo, and firecracker sits on top? How is this firecracker and not a KvM thing

[–] bulk88 20 hours ago
They C debugging APIs and root permissions in the Host OS to exploit a user mode process in the Host OS. Fire is hot. Water is wet.
[–] tptacek 13 hours ago
The jailer doesn't give you debugging APIs to work with. Jailed, if your original exploit only gives you RCE in Firecracker itself, you still need another LPE vulnerability to break the sandbox.

If they have arbitrary code execution in the Linux kernel itself (which it feels like maybe they should?) then the jailer is a nonfactor. But the exploit they write up sure seems like it's just getting code execution in userland from Firecracker itself.

[–] bulk88 6 hours ago
memory_fd = open("/dev/mem", O_RDWR | O_SYNC | O_CLOEXEC); mapping = mmap(NULL, PAGE_SIZE_U64, prot, MAP_SHARED, descriptor, (off_t)alias_gpa_for_hpa(page_hpa));

Sure looks like a C hello world kernel debugger.

[–] tptacek 6 hours ago
The jailer exposes neither /dev/mem nor anything you could use to make the device node for it.