The exploit walks EPT tables from a guest nonce to locate the Firecracker process and hijack its vCPU thread.
FIRECRACKER MICROVM ESCAPE ACHIEVES ROOT ON HOST
*Researchers from PWN Research demonstrate a full host takeover using a Firecracker microVM. The chain manipulates saved registers, redirects execution, and leaves the VM accessible over SSH. The exploit is catalogued as CVE‑2026‑99999.*
A PWN Research team has shattered the security promise of Firecracker microVMs. By exploiting a host‑memory primitive disclosed in Part 1, they traced a guest‑placed nonce through Extended Page Tables, reverse‑mapped host page tables, and seized control of a vCPU thread. The result: root‑level code execution on the host while the guest VM stayed online via SSH. The chain, documented as CVE‑2026‑99999, proves that Firecracker’s isolation can be bypassed when an attacker can read and write arbitrary host physical memory. The researchers detail each step, from locating the saved pt_regs structure to redirecting execution at the KVM_RUN return point.
How did the exploit hijack the vCPU thread?
Firecracker runs each virtual CPU in a host thread that enters KVM via ioctl(vcpu_fd, KVM_RUN, 0 ). While inside KVM, the kernel stores the thread’s userspace registers in a pt_regs structure. The researchers discovered that by locating and modifying this saved frame they could choose the code executed when the thread returned to userspace. Using a host‑memory primitive obtained in Part 1, they identified the exact pt_regs entry for the active vCPU, overwrote the instruction pointer, and forced Firecracker to call a payload of their choosing. The guest then restored the temporary stack changes, allowing the VM to stay alive and reachable over SSH while the host ran attacker code as root.
Mapping guest memory to host physical address
The attack began with a recognizable byte pattern – a nonce – placed in a guest page. The resolver took the known guest physical address (GPA) and the nonce, then scanned host physical ranges for candidate Extended Page Table (EPT) roots. For each root it walked the EPT entries until reaching a physical page, checking the page’s contents for the nonce. Two candidates emerged; validation narrowed them to a single EPT root. Walking that root yielded the host physical address (HPA) of the guest page, dubbed guest_page_hpa, which became the anchor for the next stage of the chain.
Identifying the Firecracker process in host memory
Firecracker maps guest memory into its own address space, providing a back‑door to the host process. The reverse mapper searched native host page tables for a mapping of guest_page_hpa. It started with a virtual address, walked the page tables, and looked for a physical page matching the known HPA. When a match was found, the mapper recovered the virtual address and the page global directory (PGD) root. A nonce check confirmed the mapping. This yielded a single validated address space, stored as host_pgd, and allowed the researchers to locate the Firecracker ELF image, compute its load bias (firecracker_base), and pinpoint the runtime code address needed for the exploit.
From EPT root to code execution: the final chain
With firecracker_base in hand, the team calculated the runtime address of a callable function inside Firecracker’s write(2) wrapper. They patched the saved pt_regs frame to point the instruction pointer at this address. When the vCPU thread returned from KVM_RUN, Firecracker executed the attacker‑chosen call, granting code execution as root on the host. The exploit demonstrates CVE‑2026‑99999 on a live Firecracker setup, showing that untrusted code can break out of the microVM isolation model and control the underlying host.
Frequently asked questions
What vulnerability does CVE-2026-99999 exploit in Firecracker?
It exploits the ability to locate and modify the saved pt_regs frame of a vCPU thread via a host‑memory primitive, allowing code execution as root when the thread returns from KVM_RUN.
How did the researchers locate the Firecracker process from inside the VM?
They placed a nonce in a guest page, resolved its host physical address through an EPT walk, then reverse‑mapped host page tables to find the virtual address and PGD that mapped that page, confirming the Firecracker process.
What was the impact of the escape on the compromised VM?
The exploit gave the attacker root on the host while Firecracker kept running, and the VM remained accessible over SSH.
The Firecracker escape underscores the fragility of microVM isolation when host memory primitives are exposed. With root on the host, attackers can pivot to any service, compromise data, and persist across reboots. The public disclosure of CVE‑2026‑99999 forces cloud providers and developers to reassess threat models around untrusted workloads. Until mitigations are deployed, the line between guest and host remains dangerously thin.
Sources: Hacker News – Firecracker VM Escape: PwnEscape Part 2 (https://pwn.ai/blog/firecracker-escape)