CVE-2026-5747 Overview
An out-of-bounds write vulnerability exists in the virtio PCI transport component of Amazon Firecracker, a lightweight virtualization technology designed for creating and managing secure, multi-tenant container and function-based services. This vulnerability affects Firecracker versions 1.13.0 through 1.14.3 and version 1.15.0 running on both x86_64 and aarch64 architectures.
The flaw allows a local guest user with root privileges to modify virtio queue configuration registers after device activation, potentially leading to a crash of the Firecracker VMM (Virtual Machine Monitor) process or, under specific preconditions, arbitrary code execution on the host system.
Critical Impact
A malicious guest with root access can escape the virtualization boundary, potentially compromising the host system and other co-located workloads. Code execution on the host requires additional preconditions such as custom guest kernels or specific snapshot configurations.
Affected Products
- Amazon Firecracker 1.13.0 through 1.14.3 on x86_64
- Amazon Firecracker 1.13.0 through 1.14.3 on aarch64
- Amazon Firecracker 1.15.0 on x86_64 and aarch64
Discovery Timeline
- April 8, 2026 - CVE-2026-5747 published to NVD
- April 8, 2026 - Last updated in NVD database
Technical Details for CVE-2026-5747
Vulnerability Analysis
This out-of-bounds write vulnerability resides in the virtio PCI transport layer of Amazon Firecracker. The virtio specification provides a standardized interface for virtual devices in hypervisors, and the PCI transport mechanism handles communication between guest operating systems and the VMM.
The vulnerability occurs when virtio queue configuration registers are modified after a device has already been activated. During normal operation, these registers should only be configured during the device initialization phase. However, improper validation allows a privileged guest user to manipulate these registers post-activation, resulting in an out-of-bounds write condition.
When exploited, this flaw can corrupt memory within the Firecracker VMM process. The immediate consequence is a denial of service through a process crash. However, with careful manipulation and specific environmental conditions—such as running a custom guest kernel or utilizing particular snapshot configurations—an attacker could potentially achieve arbitrary code execution on the host system, effectively escaping the virtual machine boundary.
Root Cause
The root cause is insufficient validation of virtio queue configuration register modifications after device activation. The Firecracker VMM fails to properly enforce the expected lifecycle constraints on these configuration registers, allowing writes that should be rejected once the device enters an active state. This results in memory writes to unintended locations (CWE-369: Divide By Zero is listed but the actual behavior indicates CWE-787: Out-of-bounds Write).
Attack Vector
The attack requires local access from within a guest virtual machine with root privileges. An attacker positioned as a privileged user inside a Firecracker guest can interact directly with the virtio PCI transport layer through standard device interfaces.
The attack sequence involves:
- Attacker gains root access within a Firecracker guest VM
- The attacker identifies the virtio PCI device interfaces
- After the device is fully activated, the attacker modifies virtio queue configuration registers
- The VMM processes these modifications without proper bounds checking
- An out-of-bounds write occurs, crashing the VMM or enabling code execution
Code execution on the host requires additional preconditions. The attacker may need to utilize a custom guest kernel that provides direct access to device configuration spaces or leverage specific snapshot configurations that create exploitable memory layouts.
Detection Methods for CVE-2026-5747
Indicators of Compromise
- Unexpected crashes of the Firecracker VMM process (firecracker binary)
- Abnormal virtio device register access patterns from guest VMs
- Suspicious memory corruption or segmentation faults in VMM logs
- Guest VMs running custom or unsigned kernels attempting device manipulation
Detection Strategies
- Monitor Firecracker process stability and log unexpected terminations with crash dump analysis
- Implement syscall monitoring for unusual ioctl calls targeting virtio device files
- Deploy runtime integrity monitoring on hosts running Firecracker workloads
- Alert on guest VMs loading custom kernel modules that interact with virtio interfaces
Monitoring Recommendations
- Enable detailed logging for Firecracker VMM processes to capture device configuration changes
- Configure crash dump collection and analysis for Firecracker process failures
- Implement network segmentation and monitoring for multi-tenant Firecracker deployments
- Review guest VM boot configurations for unauthorized kernel modifications
How to Mitigate CVE-2026-5747
Immediate Actions Required
- Upgrade Firecracker to version 1.14.4 or 1.15.1 immediately
- Audit running Firecracker instances to identify affected versions
- Review guest VM configurations for custom kernels or unusual snapshot settings
- Restrict root access within guest VMs where possible
Patch Information
Amazon has released patched versions that address this vulnerability. Users should upgrade to the following versions:
- For the 1.14.x branch: Upgrade to Firecracker v1.14.4
- For the 1.15.x branch: Upgrade to Firecracker v1.15.1
Additional details are available in the AWS Security Bulletin 2026-015 and the GitHub Security Advisory GHSA-776c-mpj7-jm3r.
Workarounds
- Limit root access within guest VMs to reduce the attack surface
- Avoid using custom guest kernels in production environments until patching is complete
- Implement strict snapshot configuration policies to minimize exploitable conditions
- Consider isolating high-risk workloads on separate physical infrastructure
# Verify current Firecracker version
firecracker --version
# Upgrade to patched version (example for 1.14.4)
wget https://github.com/firecracker-microvm/firecracker/releases/download/v1.14.4/firecracker-v1.14.4-x86_64.tgz
tar -xzf firecracker-v1.14.4-x86_64.tgz
sudo cp release-v1.14.4-x86_64/firecracker-v1.14.4-x86_64 /usr/local/bin/firecracker
sudo chmod +x /usr/local/bin/firecracker
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
