Source: PWN.AI security research advisory 'Firecracker VM Escape: PwnEscape Part 2' by Paulos Yibelo published November 6, 2026.
The attack targets the boundary where a Firecracker host process manages vCPU threads via the standard ioctl(vcpu_fd, KVM_RUN, 0) system call. While the vCPU thread executes in KVM, the host kernel stores its saved userspace registers inside a pt_regs structure. The researchers recognized that poisoning this saved frame before execution resumed in userspace would grant direct control over Firecracker's execution path.
To navigate host memory without prior knowledge of physical layout, the exploit placed a recognizable byte sequence into a guest page and crawled host memory to locate candidate Extended Page Table (EPT) roots. Validating the translation narrowed the search to a single host physical address, allowing a reverse mapper to recover Firecracker's Page Global Directory (PGD), identify the ELF binary, and compute the ASLR load bias.
The proof of concept staged an eight-byte marker string on Firecracker's private stack and redirected the saved instruction pointer to Firecracker's internal write wrapper. To ensure clean return without crashing the hypervisor, the payload chained an 'xor eax, eax; ret' gadget to zero the return value before returning execution to the original ioctl continuation.
The researchers emphasized that the demonstration ran Firecracker without its standard jailer harness; deployments that strictly enforce Firecracker's chroot jailer, unprivileged user namespaces, and restrictive seccomp filters would constrain post-exploitation capabilities even if VMM control is achieved.