Firecracker Security Alert: Virtio-PCI Vulnerability Could Lead to Out-of-Bounds Memory Access

AWS has issued a high-severity security advisory for Firecracker, the open-source virtualization technology purpose-built for high-scale, multi-tenant services like AWS Lambda and Fargate. The vulnerability, tracked as CVE-2026-5747 with a CVSS score of 8.7, involves an out-of-bounds (OOB) write flaw within the virtio-pci transport layer.

Firecracker is designed to provide secure isolation between tenants, but this newly discovered issue exists where “a root-privileged guest can modify virtio queue configuration registers after device activation”.

Typically, bounds validation is performed during the initialization phase to ensure memory safety. However, this flaw allows a guest with root privileges to modify the queue_size register after the device is already active. By changing this value post-initialization, the guest can “bypass bounds validation performed during initialization,” potentially causing a system-wide failure or memory corruption.

The consequences of exploiting this vulnerability vary based on the guest environment:

• Denial of Service: The modification can trigger a “process panic (denial of service) via divide-by-zero”.
• Memory Corruption: Attackers can trigger “out-of-bounds writes up to 524,284 bytes beyond the virtio queues”.
• Host-Level Risk: While standard Linux kernels typically keep this OOB access within guest memory, “to achieve OOB access beyond guest memory into the Firecracker process’s host memory, additional preconditions must be satisfied”. This higher level of exploitation requires specific configurations, such as a custom guest kernel or specialized snapshots.

The vulnerability impacts Firecracker versions 1.13.0, 1.14.3, and 1.15.0. AWS has moved quickly to release patches to secure the ecosystem.

For administrators who cannot upgrade immediately, a simple configuration change can mitigate the risk. The virtio PCI transport is an opt-in feature enabled via the –enable-pci flag.

The advisory notes that “the legacy MMIO transport is the default and is not affected by this issue”. Users can protect their systems by “removing the –enable-pci flag from their Firecracker invocation”. However, be aware that reverting to the legacy MMIO transport “may result in reduced I/O throughput and increased latency”.

Security teams are encouraged to prioritize the 1.14.4 or 1.15.1 upgrades to maintain both performance and a robust security posture.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Do Son

Do Son (aka Ddos) is a seasoned news reporter, bringing over a decade of expertise to the forefront of cyber security and technology reporting. My work provides timely and insightful analysis of emerging trends and critical developments in these rapidly evolving sectors.