Corrupting memory in Rust sandbox Firecracker: failed mmap turns guest writes into VMM writes

moyix · x · 2026-11-07

Security researcher @JcryPto explains how memory corruption was achieved inside a Rust-written Firecracker microVM sandbox:

The spark was an unsafe block: after unmapping a guest-RAM page, mmap(MAPFIXED) failed.
KVM kept pointing that guest physical address at the old page, which Firecracker had already reused for VMM memory.
Result: guest writes became writes into the VMM itself — a sandbox-escape primitive.

A textbook case of "Rust safety ≠ absolute safety": an unhandled mmap failure in unsafe code desynchronized the virtualization layer's and host's memory mapping. Directly relevant to sandbox/isolation security work.

Original post →

Corrupting memory in Rust sandbox Firecracker: failed mmap turns guest writes into VMM writes

More from Safety