Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

firecracker-microvm/firecracker

              main @ ce26972
            

Fixes

CVEs

CRITICAL

Peak severity

51.6%

Coverage

Highlights

Denial of Service: 44 prior fixes. Scrutinize any change in this area.

jailer: most-fixed (4 issues). Treat as high-risk during review.

23 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: Guest systems can bypass memory isolation or write to unallocated ranges if the host VMM does not strictly protect unplugged memory boundaries. Applying PROT_NONE prevents guest-triggered sandbox compromises.

Out-of-bounds Write: Improper validation of host addresses translated from guest memory descriptors in the virtio-vsock implementation can lead to severe memory corruption and potential code execution on the host system (CVE-2019-18960).

Auth Bypass: MMDS session tokens could be reused across virtual machines if the encryption scheme does not bind VM-specific metadata. Using VM instance-id as Additional Authenticated Data (AAD) prevents token migration.