Firecracker VM Escape: PwnEscape Part 2 news update

Security researchers at pwn.ai published technical research demonstrating an escape from AWS Firecracker microVMs that yields root code execution on the host system, documented in pwn.ai's report. The demonstration takes advantage of a host physical memory mapping primitive established in an earlier phase of the exploit chain to discover the parent hypervisor process, locate its kernel register structures, and hijack a live virtual processor thread without crashing the guest. By intercepting execution when the underlying thread exits kernel space, the team achieved arbitrary function calling in the managing process while keeping the guest operational and accessible via SSH under vulnerability tracking designation CVE-2026-99999.

This technical breakdown examines the multi-stage memory resolution technique, the manipulation of kernel register frames, and the mechanics of hijacking live virtualization threads. Cloud infrastructure engineers, hypervisor developers, and security architects running multi-tenant container or serverless workloads will find practical details on the specific memory translation pathways, EPT table traversals, and thread return hooks analyzed in the exploit chain.

Firecracker VM Escape: what actually changed

The demonstration changes how security researchers evaluate the boundary between guest microVMs and the host managing process under KVM. Rather than attacking virtio devices or emulated hardware peripherals directly, the exploit chain focuses on the host kernel state saved during active execution of the guest. When a Firecracker vCPU executes code inside the guest environment, its parent host thread waits inside an ioctl system call targeting KVM_RUN. During this waiting state, the host kernel retains the userspace thread registers inside a pt_regs structure, holding both the instruction pointer where execution will resume and the stack pointer for userspace operation.

By using an existing host memory read-and-write primitive, the researchers demonstrated that an attacker inside the guest can resolve the translation tables between guest physical addresses and host physical addresses. This allows the guest to discover the host page global directory, verify the running Firecracker ELF binary in host memory, and identify the exact pt_regs structure corresponding to the active vCPU thread. The attacker alters these saved registers before triggering a VM exit, causing Firecracker to execute attacker-controlled instructions in userspace upon returning from KVM.

Firecracker VM Escape: how it works

The exploit operates through four sequential memory resolution stages, beginning with a known byte sequence placed on a controlled guest page. Because guest physical addresses differ from host physical addresses, the exploit scans candidate Extended Page Tables roots across accessible host physical memory. It traverses the nested page tables using the guest physical address and checks the destination memory for the embedded nonce. After resolving the unique EPT root and obtaining the host physical address of the guest page, a reverse-mapping routine scans native host page tables to identify which host process maps that physical page, returning the page global directory of the managing Firecracker instance.

Once the host page global directory is isolated, the exploit locates the Firecracker ELF image by matching a known byte sequence in Firecracker's write wrapper. Calculating the load bias relative to the base ELF layout uncovers the exact runtime memory addresses of the binary's code sections, including the ioctl continuation point and an xor eax, eax return gadget. The exploit then scans host memory for an active pt_regs structure where the saved instruction pointer, file descriptor range, system call state, and stack pointers match the live KVM_RUN execution frame. Modifying this frame redirects Firecracker's control flow upon KVM exit to write the eight-byte string N8V23M2 to its standard error stream before restoring stack integrity.

Firecracker VM Escape: why it matters

This research demonstrates a reliable path to arbitrary code execution that preserves hypervisor stability. Traditional hypervisor escapes frequently crash the virtual machine monitor or leave the host kernel in an inconsistent state, immediately alerting monitoring infrastructure and terminating guest connectivity. In this implementation, the guest modified the temporary stack adjustments after execution, allowing Firecracker to continue operating normally while remaining fully accessible over SSH throughout the takeover.

The technique also illustrates the risk of exposing raw physical memory primitives within multi-tenant hypervisors. When a guest can read or write host physical memory ranges, hardware-assisted virtualization controls such as Extended Page Tables do not prevent the guest from locating host kernel objects. Attackers can leverage predictable register structures like pt_regs to bypass address space layout randomization and hijack managing threads without needing an independent host-side memory corruption bug in Firecracker's userspace code.

Firecracker VM Escape: who is affected

The vulnerability chain tracked as CVE-2026-99999 affects virtualized host deployments running Firecracker microVMs where an attacker can obtain a host physical memory read and write primitive. Multi-tenant infrastructure environments that execute untrusted code inside isolated microVMs rely on Firecracker to enforce strict tenant separation. While Firecracker isolates virtual CPUs into distinct threads and restricts access via system call filters, the execution model requires threads to invoke KVM_RUN, creating the target register frames inside the host kernel.

Operators using Firecracker to isolate untrusted serverless functions, multi-tenant container runtimes, or customer-provided machine code face potential host takeover if an underlying memory mapping primitive exists. Once an attacker gains root access within the managing Firecracker process, the security boundary separating microVM tenants from the bare-metal host dissolves, exposing neighboring processes, internal networking interfaces, and persistent host storage.

Firecracker VM Escape: what to watch

Infrastructure teams and kernel developers should track updates regarding how host kernels expose physical memory ranges and how virtual machine monitors manage transition states during vCPU execution. Security teams must monitor kernel patches addressing the initial host memory access primitives that enabled this second-stage chain, as well as hardening measures designed to protect thread register frames while blocked inside virtualization system calls.

Organizations running Firecracker should verify that microVM guests operate with minimal privileges and that host memory access is strictly partitioned. Administrators should audit host configurations for unpatched vulnerabilities, ensure seccomp profiles restrict unauthorized ioctl actions, and maintain monitoring capable of detecting unexpected modifications to host page table directories and managing thread registers.