Microarchitectural Security of Firecracker VMM for Serverless Cloud Platforms

Firecracker is a virtual machine manager (VMM) purpose-built by AWS for serverless cloud platforms—services that run code for thousands of end users on a per-task basis, automatically managing server infrastructure. In addition to architectural attacks, AWS states that microarchitectural attacks are included in their threat model. But this class of attacks relies on shared hardware, just as the scalability of serverless computing does, which opens a conflict of interest. In this work, we investigate just how secure Firecracker is against microarchitectural attacks. We review Firecracker’s stated isolation model and recommended best practices for deployment, identify potential threat models for serverless platforms, and analyze potential weak points. Then, we use microarchitectural attack PoCs to test the isolation provided by Firecracker and find that it offers little protection against Spectre or MDS attacks. We discover two particularly concerning cases: (1) a Medusa variant that threatens Firecracker VMs but not processes running outside of them, and is not mitigated by defenses recommended by AWS, and (2) a Spectre-PHT variant that remains exploitable even if recommended countermeasures–including disabled SMT–are in place.