Firecracker isolates untrusted workloads in lightweight virtual machines, including environments used for cloud functions and AI agents. Researchers demonstrated an escape from guest userspace: root inside the guest, without control of its kernel, could read and modify live memory in Firecracker’s host-side virtual-machine monitor (VMM), then execute code there. The flaw affected machines restored from snapshots using the File memory backend when a balloon or virtio-mem device discarded guest memory. Under memory pressure, a failed fixed-address replacement could remove the snapshot mapping while leaving its KVM memory slot active. When Firecracker reused that address, the guest’s access still reached the new VMM allocation. The researchers’ exploit triggered this failure with a per-microVM memory limit.
A second weakness, FC-03, let compromised VMM code use host operations blocked by Firecracker’s seccomp policy. In particular, it could create a fresh io_uring ring and use it to send a message to a host loopback listener; related tests also demonstrated filesystem changes. These actions remained subject to the Firecracker process’s credentials and jailer constraints. A separate test combined the chain with Linux CVE-2026-43366 to panic a vulnerable host; host-kernel code execution was not attempted. The memory flaw, CVE-2026-122192, affects Firecracker v0.23.0 through v1.16.1 and is fixed in v1.16.2 and v1.17.0. A seccomp redesign is under review for FC-03. AWS says its services, including Lambda, are unaffected and require no customer action.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A URL-encoding flaw in Hugging Face Chat let unauthenticated requests bypass an admin check and trigger bulk exports of users’ private conversations. The exported data was sent to a configured dataset destination rather than returned directly to the requester. (twitter.com)
Claude Code’s “Don’t Ask Again” setting was linked to passwords and other secrets being exposed in 1,122 public GitHub files. The finding highlights how coding-agent features can accidentally put sensitive data into public code repositories. (apiiro.com)
Hackers stole $133 million from a French bank by targeting a service provider. The available details do not explain how the attack was carried out. (bleepingcomputer.com)
U.S. intelligence reportedly believes Nvidia CEO Jensen Huang had a romantic relationship with suspected Chinese spy Alice Huang, who allegedly sought access to restricted AI chips. Alice Huang is linked to Megaspeed, whose subsidiary faces allegations of smuggling $2 billion in AI chips into China. (tomshardware.com)
A report alleges China is linked to at least 18 overseas police stations in Canada, including three in the Greater Toronto Area. The RCMP is investigating reports of criminal activity connected to the stations. (ctvnews.ca)
Colframe is a low-interaction honeypot that imitates supermarket refrigeration controllers from Danfoss and Dixell. It is designed to attract and observe activity targeting these systems, including Modbus-based threats. (github.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.