bulk88

memory_fd = open("/dev/mem", O_RDWR | O_SYNC | O_CLOEXEC); mapping = mmap(NULL, PAGE_SIZE_U64, prot, MAP_SHARED, descriptor, (off_t)alias_gpa_for_hpa(page_hpa));

Sure looks like a C hello world kernel debugger.

The malware infection has been identified as Clang, part of the LLVM threat actor. To clear this infection unlink the directories named /dev and /proc on Ubuntu.

They C debugging APIs and root permissions in the Host OS to exploit a user mode process in the Host OS. Fire is hot. Water is wet.

Security Exploit requires layering with a Sys Admin Permission Exploit. Nuff said.

This so-called Firecracker exploit never explained how the Guest was able to write to the Host OS's Firecracker user mode process. If the write controlled by the guest to the host was that TCP/IP routing stack Exploit in the host OS's Linux kernel, this Firecracker Exploit is meaningless. The Guest already has unlimited control over the host OS.

I (and anyone) can do this exploit in 2-3 minutes using GDB or Visual Studio's C debugger tool. Freeze process, type new pointers into CPU context snap shot, click resume, Exploit done.

Right, the window tool debounces the events, IMO the battery attach/disconnnect messages are a poor mans heartbeat signal on the protocol. That ACPI/Windows didn't "sleep" the USB port, or that the controller in the UPS (chinese junk) didn't crash.

The development environment does not work anywhere except Mac OS. This is not FOSS, just a startup that Apple is going to buy really soon and make it there cloud computing platform.