290 points • 6 days ago • Article Link

Firecracker microVMs 用于隔离不可信代码，但研究人员已经成功演示了一种 guest-to-host 逃逸：在宿主机上实现 root 级别的代码执行。研究人员通过利用 Firecracker 管理 virtual CPU threads 的方式中存在的漏洞，在某个 thread 从 KVM hypervisor 返回时劫持了执行流。整个过程包括在宿主内存中定位 Firecracker 进程、识别特定的 thread registers，并将 thread 重定向以执行未授权操作，然后在不导致 VM 崩溃的前提下把它返回到原本的执行路径。

这条逃逸链首先借助此前建立的宿主内存原语，在宿主的物理内存空间中识别出 guest 。研究人员在 guest page 中放入一个 nonce，并通过 Extended Page Tables 将其转换为宿主物理地址。随后，他们反向映射宿主的页表，找到 Firecracker 进程对应的特定虚拟地址空间。通过分析进程内存，研究人员确定了可执行文件的 load bias，从而能够绕过 Address Space Layout Randomization，并定位关键代码段，例如 write 系统调用的 wrapper 。

完成进程映射后，重点转向寻找 virtual CPU 的 saved register state 。当 thread 调用 KVM_RUN 以执行 guest 指令时，内核会保存其 userspace register frame 。研究团队通过查找与正在进行的 KVM_RUN 调用特征相匹配的 frame，精确定位到 saved instruction pointer 和 stack 的具体位置。这一步非常关键，因为它为覆盖 thread 的返回路径提供了稳定目标，使得注入自定义逻辑成为可能。

最终的 exploit 构造了一个 payload，强迫 Firecracker 进程向自身的 stderr 执行 write 操作，作为概念验证。研究团队修改了 saved register frame，将 thread 重定向到 Firecracker 二进制中的 write wrapper，并传入所需参数。为维持系统稳定性，他们仔细构建了一个临时的返回序列，清除返回值后跳回原始的 ioctl continuation point 。在通过 serial port write 触发该操作后，exploit 成功执行，且 VM 仍保持可运行、可访问。

这项研究凸显了 virtualization environments 中内存管理带来的重大安全影响。尽管这份概念验证是在以 root 身份运行、且未配 jailer 的 Firecracker 环境中完成的，但它表明：一旦攻击者获得对宿主内存的访问权限，guest 与 host 之间的边界就可能被打破。该 exploit 的成功已通过可观察的输出以及随后对宿主线程状态的恢复得到证实，这有力证明了如何将复杂的基于内存的原语串联起来，从而破坏宿主的完整性。 Firecracker microVMs are designed to isolate untrusted code, yet researchers have successfully demonstrated a guest-to-host escape that achieves root-level code execution on the host machine. By exploiting vulnerabilities in the way Firecracker manages virtual CPU threads, the researchers were able to hijack execution flow when a thread returned from the KVM hypervisor. This process involved locating the Firecracker process in host memory, identifying specific thread registers, and redirecting the thread to perform unauthorized actions before returning it to its original execution path without causing the VM to crash.

The escape chain began by using a previously established host memory primitive to identify the guest in the host's physical memory space. Researchers placed a nonce in a guest page and used Extended Page Tables to translate it to a host physical address. From there, they reverse-mapped the host page tables to find the specific virtual address space of the Firecracker process. By analyzing the process memory, they identified the executable's load bias, which allowed them to account for Address Space Layout Randomization and locate critical code segments, such as the wrapper for the write system call.

With the process mapped, the focus shifted to finding the saved register state of the virtual CPU. When a thread calls KVM_RUN to execute guest instructions, the kernel saves its userspace register frame. By searching for a frame that matched the characteristics of an active KVM_RUN call, the team pinpointed the exact location of the saved instruction pointer and stack. This discovery was crucial because it provided a stable target for overwriting the return path of the thread, enabling the injection of custom logic.

The final exploit involved crafting a payload that would force the Firecracker process to execute a write operation to its own stderr, serving as a proof of concept. The team modified the saved register frame to redirect the thread to a write wrapper in the Firecracker binary, providing it with the necessary arguments. To maintain system stability, they carefully constructed a temporary return sequence that cleared the return value and jumped back to the original ioctl continuation point. After triggering the operation via a serial port write, the exploit successfully executed while the VM remained functional and accessible.

This research highlights the significant security implications of memory management within virtualization environments. While this specific proof of concept was executed against a Firecracker setup running as root without a jailer, it underscores that once an attacker gains access to host memory, the boundary between the guest and host can be breached. The success of this exploit, confirmed by the observable output and the subsequent restoration of the host thread's state, serves as a powerful demonstration of how complex memory-based primitives can be chained to compromise host integrity.