{"id":"GHSA-48ww-rqpp-2mgm","kind":"vulnerability","aliases":["GHSA-48ww-rqpp-2mgm"],"related":[],"title":"CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard","description":"CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard\n\n### CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard\n\nBulletin ID: 2026-169-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/04/2026 11:30 AM PST\n\nDescription:\n\nFirecracker is an open source virtualization technology that powers AWS Lambda and other serverless compute services. We identified CVE-2026-122192, an issue in Firecracker v0.23.0 through v1.16.1 that, under certain host memory conditions, can let a root user in a guest read or modify memory of the Firecracker process. It affects VMs restored from a snapshot using the File memory backend with a balloon or virtio-mem device.\n\nAWS services including AWS Lambda are not affected by this issue. No customer action is required.\n\nImpacted versions: Firecracker v0.23.0 through v1.16.1, inclusive.\n\nWithin the currently supported release lines, v1.16.0 and v1.16.1 are affected. The fix is included in v1.16.2 and v1.17.0\n\nResolution:\n\nThis issue is fixed in Firecracker v1.16.2 and v1.17.0. If you restore VMs using the File memory backend with a balloon or virtio-mem device, we recommend upgrading to Firecracker v1.16.2, v1.17.0 or later. Operators maintaining forks or derivative code should incorporate the corresponding fixes.\n\nWorkarounds:\n\nIf upgrading is not immediately possible, restore snapshots using the Uffd memory backend, following its documented requirements for handling discarded pages.\n\nThe following measures address known host-memory failure conditions:\n\n- On kernels without the Linux 6.12 overcommit-handling change, use heuristic overcommit (vm.overcommit_memory=0) and keep the maximum discard size no greater than the host’s total RAM plus swap.\n- Keep the memory cgroup’s out-of-memory (OOM) killer enabled.\n\nThese measures do not prevent every replacement-mapping failure.\n\nReferences:\n\n- CVE-2026-122192\n- GHSA-48ww-rqpp-2mgm\n\nAcknowledgement:\n\nWe thank Juan Pablo Martinez Kuhn from Coinspect for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"Firecracker, the virtualization technology behind AWS Lambda, has a flaw in VMs restored from a snapshot that use the File memory backend with a balloon or virtio-mem device. Under certain host memory conditions, a root user inside the guest can read or modify memory of the Firecracker process.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","firecracker","lab-disclosure","microvm","runtime","self-hosted","snapshot-restore"],"not_affected_if":["aws-managed-services","no-balloon-or-virtio-mem","no-snapshot-restore","uffd-backend"],"how_to_check":"- Check the Firecracker version with `firecracker --version`; versions `v0.23.0` through `v1.16.1` are affected.\n- Look for VMs restored from snapshots that use the File memory backend together with a balloon or virtio-mem device.\n- Check whether the host runs on a kernel without the Linux 6.12 overcommit-handling change.","fix":"- Upgrade Firecracker to `v1.16.2` or `v1.17.0` or later.\n- Operators maintaining forks or derivative code should incorporate the corresponding fixes.","status":"open","published_at":null,"first_seen_at":"2026-11-04T19:56:47+00:00","triaged_at":"2026-11-04T19:56:54+00:00","updated_at":"2026-11-04T19:56:54+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-04T19:56:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Firecracker to `v1.16.2` or `v1.17.0` or later.\n- Operators maintaining forks or derivative code should incorporate the corresponding fixes.","reach":"local","title":"Firecracker: a root guest user can read or change host process memory","impact":"high","summary":"Firecracker, the virtualization technology behind AWS Lambda, has a flaw in VMs restored from a snapshot that use the File memory backend with a balloon or virtio-mem device. Under certain host memory conditions, a root user inside the guest can read or modify memory of the Firecracker process.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["firecracker","self-hosted","microvm","snapshot-restore"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Guest root reads or modifies the Firecracker host process memory","analyst_note":"","how_to_check":"- Check the Firecracker version with `firecracker --version`; versions `v0.23.0` through `v1.16.1` are affected.\n- Look for VMs restored from snapshots that use the File memory backend together with a balloon or virtio-mem device.\n- Check whether the host runs on a kernel without the Linux 6.12 overcommit-handling change.","plain_action":"","needs_analyst":false,"not_affected_if":["aws-managed-services","uffd-backend","no-balloon-or-virtio-mem","no-snapshot-restore"],"who_is_affected":"Exposure requires Firecracker v0.23.0 through v1.16.1, VMs restored from a snapshot, the File memory backend, and a balloon or virtio-mem device. Teams running self-hosted Firecracker microVMs should look at these settings. AWS states that Lambda and other AWS services are not affected and that no customer action is required for them.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00083,"input_tokens":4926,"output_tokens":675,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-122192':3A,90C,104C,156C,384C '-169':119C '-2026':2A,89C,103C,155C,383C '0':342C '11':131C '11/04/2026':130C '2026':118C '2mgm':19A,24A,389C '30':132C '48ww':17A,22A,387C '6.12':332C 'access':5A,92C,106C 'acknowledg':390C 'action':219C 'address':320C 'affect':187C,213C,239C 'attent':127C 'aw':25B,43B,120C,122C,145C,206C,209C 'aws-security@amazon.com':412C 'backend':59B,197C,266C,308C 'balloon':62B,200C,269C 'behind':42B 'bulletin':116C 'certain':69B,166C 'cgroup':362C 'chang':336C 'code':289C 'coinspect':398C 'collabor':400C 'comput':150C 'concern':418C 'condit':72B,169C,326C 'content':123C 'coordin':406C 'correspond':293C 'current':231C 'custom':218C 'cve':1A,88C,102C,154C,382C 'date':129C 'deriv':288C 'descript':135C 'devic':67B,205C,274C 'discard':14A,101C,115C,315C,347C 'disclosur':29B,408C 'document':311C 'email':411C 'enabl':370C 'everi':376C 'fail':12A,99C,113C 'failur':325C,380C 'file':57B,195C,264C 'firecrack':7A,26B,38B,86B,94C,108C,136C,160C,184C,224C,254C,279C 'fix':241C,252C,294C 'flaw':47B 'follow':309C,318C 'fork':286C 'ghsa':16A,21A,386C 'ghsa-48ww-rqpp-2mgm':15A,20A,385C 'greater':350C 'guest':4A,78B,91C,105C,177C 'handl':314C,335C 'heurist':338C 'host':34B,70B,167C,323C,353C 'host-memori':322C 'id':117C 'identifi':153C 'immedi':300C 'impact':222C 'import':125C 'includ':208C,243C 'inclus':228C 'incorpor':291C 'insid':76B 'issu':158C,216C,250C,403C 'juan':393C 'keep':344C,359C 'kernel':328C 'killer':369C 'known':321C 'kuhn':396C 'lab':28B 'lab-disclosur':27B 'lambda':44B,146C,210C 'later':283C 'let':171C 'line':234C 'linux':331C 'maintain':285C 'map':379C 'martinez':395C 'maximum':346C 'measur':319C,372C 'mem':66B,204C,273C 'memori':9A,13A,58B,71B,83B,96C,100C,110C,114C,168C,181C,196C,265C,307C,324C,341C,361C,367C 'microvm':30B 'modifi':82B,180C 'oom':368C 'open':139C 'oper':284C 'out-of-memori':364C 'overcommit':334C,339C 'overcommit-handl':333C 'pablo':394C 'page':316C 'pleas':410C 'plus':357C 'possibl':301C 'power':144C 'prevent':375C 'process':8A,87B,95C,109C,185C,409C 'pst':134C 'public':128C 'question':416C 'ram':356C 'read':80B,178C 'recommend':276C 'refer':381C 'releas':233C 'replac':378C 'replacement-map':377C 'requir':126C,221C,312C 'resolut':248C 'restor':37B,50B,189C,260C,302C 'root':74B,173C 'rqpp':18A,23A,388C 'runtim':31B 'scope':121C 'secur':415C 'self':33B 'self-host':32B 'serverless':149C 'servic':151C,207C 'size':348C 'snapshot':36B,53B,192C,303C 'snapshot-restor':35B 'sourc':140C 'support':232C 'swap':358C 'technolog':41B,142C 'thank':392C 'total':355C 'type':124C 'uffd':306C 'upgrad':277C,297C 'use':55B,193C,262C,304C,337C 'user':75B,174C 'v0.23.0':161C,225C 'v1.16.0':235C 'v1.16.1':163C,227C,237C 'v1.16.2':245C,255C,280C 'v1.17.0':247C,257C,281C 'version':223C 'virtio':65B,203C,272C 'virtio-mem':64B,202C,271C 'virtual':40B,141C 'vm.overcommit':340C 'vms':49B,188C,261C 'vulner':407C 'within':229C 'without':329C 'workaround':295C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires Firecracker v0.23.0 through v1.16.1, VMs restored from a snapshot, the File memory backend, and a balloon or virtio-mem device. Teams running self-hosted Firecracker microVMs should look at these settings. AWS states that Lambda and other AWS services are not affected and that no customer action is required for them.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aws","firecracker","labdisclosure","microvm","runtime","selfhosted","snapshotrestore","unknown"],"campaign_type":null,"first_public_at":null,"kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-169-aws/#GHSA-48ww-rqpp-2mgm","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-169-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T19:56:47+00:00","fetched_at":"2026-11-04T19:56:47+00:00","note":"AWS: CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard"}],"documents":[{"id":69922,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-169-aws/","title":"AWS: CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard","kind":"advisory","source":"lab","publisher":"research","text":"CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard\n\n### CVE-2026-122192: Guest Access to Firecracker Process Memory After a Failed Memory Discard\n\nBulletin ID: 2026-169-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 11/04/2026 11:30 AM PST\n\nDescription:\n\nFirecracker is an open source virtualization technology that powers AWS Lambda and other serverless compute services. We identified CVE-2026-122192, an issue in Firecracker v0.23.0 through v1.16.1 that, under certain host memory conditions, can let a root user in a guest read or modify memory of the Firecracker process. It affects VMs restored from a snapshot using the File memory backend with a balloon or virtio-mem device.\n\nAWS services including AWS Lambda are not affected by this issue. No customer action is required.\n\nImpacted versions: Firecracker v0.23.0 through v1.16.1, inclusive.\n\nWithin the currently supported release lines, v1.16.0 and v1.16.1 are affected. The fix is included in v1.16.2 and v1.17.0\n\nResolution:\n\nThis issue is fixed in Firecracker v1.16.2 and v1.17.0. If you restore VMs using the File memory backend with a balloon or virtio-mem device, we recommend upgrading to Firecracker v1.16.2, v1.17.0 or later. Operators maintaining forks or derivative code should incorporate the corresponding fixes.\n\nWorkarounds:\n\nIf upgrading is not immediately possible, restore snapshots using the Uffd memory backend, following its documented requirements for handling discarded pages.\n\nThe following measures address known host-memory failure conditions:\n\n- On kernels without the Linux 6.12 overcommit-handling change, use heuristic overcommit (vm.overcommit_memory=0) and keep the maximum discard size no greater than the host’s total RAM plus swap.\n- Keep the memory cgroup’s out-of-memory (OOM) killer enabled.\n\nThese measures do not prevent every replacement-mapping failure.\n\nReferences:\n\n- CVE-2026-122192\n- GHSA-48ww-rqpp-2mgm\n\nAcknowledgement:\n\nWe thank Juan Pablo Martinez Kuhn from Coinspect for collaborating on this issue through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}