Firecracker is a virtual machine manager (VMM) built by Amazon Web Services (AWS) for serverless cloud platforms, services that run code for end users on a per-task basis, automatically managing server infrastructure. Firecracker provides fast and lightweight VMs and promises a combination of the speed of containers, typically used to isolate small tasks, and the security of VMs, which tend to provide greater isolation at the cost of performance. This combination of security and efficiency, AWS claims, makes it not only possible but safe to run thousands of user tasks from different users on the same hardware, with the host system frequently switching between active tasks. Though AWS states that microarchitectural attacks are included in their threat model, this class of attacks directly relies on shared hardware, just as the scalability of serverless computing relies on sharing hardware between unprecedented numbers of users. In this work, we investigate how secure Firecracker is against microarchitectural attacks. First, we review Firecracker's stated isolation model and recommended best practices for deployment, identify potential threat models for serverless platforms, and analyze potential weak points. Then, we use microarchitectural attack proof-of-concepts to test the isolation provided by Firecracker and find that it offers little protection against Spectre or MDS attacks. We discover two particularly concerning cases: 1) a Medusa variant that threatens Firecracker VMs but not processes running outside them, and is not mitigated by defenses recommended by AWS, and 2) a Spectre-PHT variant that remains exploitable even if recommended countermeasures are in place and SMT is disabled in the system. In summary, we show that AWS overstates the security inherent to the Firecracker VMM and provides incomplete guidance for properly securing cloud systems that use Firecracker.

翻译：Firecracker是亚马逊云服务（AWS）为无服务器云平台构建的虚拟机管理器（VMM），这些平台按任务为最终用户运行代码，并自动管理服务器基础设施。Firecracker提供快速轻量级的虚拟机，兼具通常用于隔离小任务的容器的速度，以及往往以性能为代价提供更强隔离性的虚拟机的安全性。AWS声称，这种安全性与效率的结合，使得在同一硬件上运行来自不同用户的数千个用户任务成为可能且安全，主机系统需频繁在活动任务间切换。尽管AWS表示微架构攻击已纳入其威胁模型，但此类攻击直接依赖于共享硬件，正如无服务器计算的可扩展性依赖于前所未有的用户数量共享硬件一样。在本研究中，我们探究Firecracker抵御微架构攻击的安全性。首先，我们审视Firecracker宣称的隔离模型及推荐的部署最佳实践，识别无服务器平台的潜在威胁模型，并分析可能的薄弱点。随后，我们利用微架构攻击概念验证来测试Firecracker提供的隔离性，发现其对Spectre或MDS攻击的防护效果甚微。我们发现了两个特别值得关注的情况：1) 一种Medusa变体威胁Firecracker虚拟机，但不影响外部运行的进程，且AWS推荐的防御措施无法缓解；2) 一种Spectre-PHT变体，即使在系统中应用推荐对策并禁用SMT后，仍存在可利用性。总之，我们证明AWS夸大了Firecracker VMM固有的安全性，并为正确保护使用Firecracker的云系统提供了不完整的指导。