microVM monitors

Firecracker and Cloud Hypervisor are minimal KVM device monitors built for serverless and container-isolation workloads. They deliberately expose a tiny device set, virtio over MMIO, a serial console, and little else, to shrink the escape surface. Attacking them means targeting that reduced virtio and API surface and the host-side orchestration that manages many microVMs.

1 min qariaġġornat 7 ta’ Ott, 2026florianamette1 kontributur
Staqsi lill-assistent tiegħek (MCP)Editja fuq GitHub

Firecracker (from AWS) and Cloud Hypervisor are modern, minimal Virtual Machine Monitors for KVM, written in Rust and designed for serverless and container-isolation use where density and a small attack surface matter more than device breadth. They deliberately emulate almost nothing: a handful of virtio devices over MMIO (block, net, vsock, and a few others), a serial console, and a minimal interrupt controller, with no legacy PCI, no USB, no graphics, no audio. That shrinks the guest-to-host escape surface to the virtio implementations and the monitor's own API, and the Rust implementation removes most classic memory-safety bugs, so attacks focus on logic flaws, unsafe blocks, and the host-side orchestration.

bash
# identify the monitor on the host
ps -ef | grep -E 'firecracker|cloud-hypervisor' | grep -v grep
# firecracker is controlled by a REST API on a unix socket
ls -l /run/firecracker*.socket 2>/dev/null

Subtopics#

References#

Ta' qabelKnown escape exploitsLi jmiss Firecracker