points by bulk88 20 hours ago | 0 comments
They C debugging APIs and root permissions in the Host OS to exploit a user mode process in the Host OS. Fire is hot. Water is wet.
[–] tptacek 13 hours ago
[–] bulk88 6 hours ago
memory_fd = open("/dev/mem", O_RDWR | O_SYNC | O_CLOEXEC);
mapping = mmap(NULL, PAGE_SIZE_U64, prot, MAP_SHARED, descriptor, (off_t)alias_gpa_for_hpa(page_hpa));
Sure looks like a C hello world kernel debugger.
[–] tptacek 6 hours ago
The jailer exposes neither /dev/mem nor anything you could use to make the device node for it.
If they have arbitrary code execution in the Linux kernel itself (which it feels like maybe they should?) then the jailer is a nonfactor. But the exploit they write up sure seems like it's just getting code execution in userland from Firecracker itself.