{"id":49350,"date":"2026-11-07T18:03:29","date_gmt":"2026-11-07T09:03:29","guid":{"rendered":"https:\/\/jore2.com\/?p=49350"},"modified":"2026-11-07T18:03:29","modified_gmt":"2026-11-07T09:03:29","slug":"news-23201-firecracker-vm-escape-pwnescape-part-2","status":"publish","type":"post","link":"https:\/\/jore2.com\/?p=49350","title":{"rendered":"\ud30c\uc774\uc5b4\ud06c\ub798\ucee4 \ub9c8\uc774\ud06c\ub85cVM \uacbd\uacc4 \ub118\uc740 \uc545\uc131 \uac8c\uc2a4\ud2b8, \ud638\uc2a4\ud2b8 \ub8e8\ud2b8 \uad8c\ud55c \ucf54\ub4dc \uc2e4\ud589 \uc131\uacf5"},"content":{"rendered":"<div class=\"jore2-editor-byline\">\n<p><strong>\ud55c\uc11c\uc900<\/strong><\/p>\n<\/div>\n<p>\ubcf4\uc548 \uc5f0\uad6c \uae30\uad00 PWN \ub9ac\uc11c\uce58\uc758 \ud3f4\ub85c\uc2a4 \uc774\ubca8\ub85c\uac00 \uc774\ub044\ub294 \ud300\uc774 \ud30c\uc774\uc5b4\ud06c\ub798\ucee4 \ub9c8\uc774\ud06c\ub85cVM\uc758 \ubcf4\uc548 \uacbd\uacc4\ub97c \ub3cc\ud30c\ud55c \uc0c1\uc138\ud55c \uae30\uc220\uc801 \ubd84\uc11d\uc744 \uacf5\uac1c\ud588\uc2b5\ub2c8\ub2e4. \uc774\ubc88 \ubc1c\uacac\uc740 \ud30c\uc774\uc5b4\ud06c\ub798\ucee4 \ubc84\uc804 1.16.1\uc744 \uc0ac\uc6a9\ud558\ub294 \ud658\uacbd\uc5d0\uc11c \uc545\uc131 \uac8c\uc2a4\ud2b8\uac00 \ud638\uc2a4\ud2b8 \uba38\uc2e0\uc758 \ub8e8\ud2b8 \uad8c\ud55c\uc73c\ub85c \uc784\uc758 \ucf54\ub4dc\ub97c \uc2e4\ud589\ud560 \uc218 \uc788\uc74c\uc744 \uc2e4\uc99d\ud55c \uc0ac\ub840\uc785\ub2c8\ub2e4.<\/p>\n<p>\uacf5\uaca9\uc758 \ud575\uc2ec\uc740 \uac00\uc0c1 CPU \uc2a4\ub808\ub4dc\uac00 KVM_RUN \uc2dc\uc2a4\ud15c \ud638\ucd9c\uc5d0 \ub9c9\ud600 \uc788\ub294 \uc21c\uac04\uc744 \ub178\ub9ac\ub294 \uac83\uc774\uc5c8\uc2b5\ub2c8\ub2e4. \uc774 \uc2dc\uc810\uc5d0 \ud638\uc2a4\ud2b8 \ucee4\ub110\uc740 \uc0ac\uc6a9\uc790 \uacf5\uac04 \ub808\uc9c0\uc2a4\ud130 \uc0c1\ud0dc\ub97c pt_regs \uad6c\uc870\uccb4\uc5d0 \uc800\uc7a5\ud569\ub2c8\ub2e4. \uc5f0\uad6c\ud300\uc740 \uac8c\uc2a4\ud2b8 \ub0b4\ubd80\uc5d0\uc11c \ud638\uc2a4\ud2b8 \ubb3c\ub9ac \uba54\ubaa8\ub9ac\uc5d0 \uc811\uadfc\ud560 \uc218 \uc788\ub294 \uc6d0\uc2dc\uc801 \uae30\ub2a5\uc744 \ud655\ubcf4\ud55c \ub4a4, \ud655\uc7a5 \ud398\uc774\uc9c0 \ud14c\uc774\ube14\uc744 \ud0d0\uc0c9\ud574 \uac8c\uc2a4\ud2b8 \ud398\uc774\uc9c0\uc640 \ud638\uc2a4\ud2b8 \ud398\uc774\uc9c0 \uac04\uc758 \ub9e4\ud551 \uad00\uacc4\ub97c \uc5ed\ucd94\uc801\ud588\uc2b5\ub2c8\ub2e4.<\/p>\n<p>\uc774 \uacfc\uc815\uc744 \ud1b5\ud574 \uc5f0\uad6c\ud300\uc740 ASLR\uc774 \uc801\uc6a9\ub41c \uc0c1\ud0dc\uc5d0\uc11c\ub3c4 \ud30c\uc774\uc5b4\ud06c\ub798\ucee4 \ubc14\uc774\ub108\ub9ac\uc758 \uc704\uce58\ub97c \ud2b9\uc815\ud560 \uc218 \uc788\uc5c8\uc2b5\ub2c8\ub2e4. \uc774\ud6c4 \ud574\ub2f9 \ud504\ub85c\uc138\uc2a4 \ub0b4\uc5d0\uc11c \uc2e4\ud589 \uac00\ub2a5\ud55c \ucf54\ub4dc \uc601\uc5ed\uc744 \ucc3e\uc544\ub0b4\uace0, \ucc28\ub2e8\ub41c vCPU \uc2a4\ub808\ub4dc\uc758 \uc800\uc7a5\ub41c RIP\uc640 RSP \ub808\uc9c0\uc2a4\ud130 \uac12\uc744 \uacf5\uaca9\uc790\uac00 \uc6d0\ud558\ub294 \uc8fc\uc18c\ub85c \ub36e\uc5b4\uc37c\uc2b5\ub2c8\ub2e4.<\/p>\n<p>\ud2b8\ub9ac\uac70 \uba54\ucee4\ub2c8\uc998\uc73c\ub85c\ub294 \uc9c1\ub82c \ud3ec\ud2b8 \uc4f0\uae30 \uc791\uc5c5\uc774 \ud65c\uc6a9\ub418\uc5c8\uc2b5\ub2c8\ub2e4. \uac8c\uc2a4\ud2b8\uac00 \uc9c1\ub82c \ud3ec\ud2b8\ub85c \ub370\uc774\ud130\ub97c \uc804\uc1a1\ud558\uba74 vCPU \uc2a4\ub808\ub4dc\uac00 KVM_RUN\uc5d0\uc11c \ubcf5\uadc0\ud558\uac8c \ub429\ub2c8\ub2e4. \uc774\ub54c \ucee4\ub110\uc740 \ubcc0\uc870\ub41c \ub808\uc9c0\uc2a4\ud130 \uac12\uc744 \ubcf5\uc6d0\ud558\uba70, \ud30c\uc774\uc5b4\ud06c\ub798\ucee4 \ud504\ub85c\uc138\uc2a4\ub294 \uacf5\uaca9\uc790\uac00 \uc120\ud0dd\ud55c \ud568\uc218\ub97c \uc790\uc2e0\uc758 \uad8c\ud55c\uc73c\ub85c \uc2e4\ud589\ud558\uac8c \ub429\ub2c8\ub2e4.<\/p>\n<p>\uc8fc\ubaa9\ud560 \uc810\uc740 \uacf5\uaca9 \uc131\uacf5 \ud6c4\uc5d0\ub3c4 VM \uc790\uccb4\uac00 \uc815\uc0c1\uc801\uc73c\ub85c \uc720\uc9c0\ub418\uc5c8\ub2e4\ub294 \uc0ac\uc2e4\uc785\ub2c8\ub2e4. SSH \uc5f0\uacb0\ub3c4 \uc0b4\uc544\uc788\uc5c8\uc73c\uba70, \ud30c\uc774\uc5b4\ud06c\ub798\ucee4 \ud504\ub85c\uc138\uc2a4\ub294 \uacc4\uc18d \ub3d9\uc791\ud588\uc2b5\ub2c8\ub2e4. \uc774\ub294 \ub2e8\uc21c\ud55c \uc11c\ube44\uc2a4 \uac70\ubd80 \uacf5\uaca9\uc774 \uc544\ub2cc, \uc644\uc804\ud55c \uc81c\uc5b4\uad8c \ud0c8\ucde8\uac00 \uac00\ub2a5\ud568\uc744 \uc758\ubbf8\ud569\ub2c8\ub2e4.<\/p>\n<p>\ub2e4\ub9cc \uc774\ubc88 \ub370\ubaa8\uc5d0\ub294 \uc911\uc694\ud55c \uc81c\uc57d \uc870\uac74\uc774 \ub530\ub985\ub2c8\ub2e4. \uc0ac\uc6a9\ub41c \uc124\uc815\uc5d0\ub294 &#8216;jailer&#8217;\uac00 \ud3ec\ud568\ub418\uc5b4 \uc788\uc9c0 \uc54a\uc558\uc2b5\ub2c8\ub2e4. jailer\ub294 \ub124\uc784\uc2a4\ud398\uc774\uc2a4 \uaca9\ub9ac\uc640 seccomp \ud544\ud130\ub9c1\uc744 \ud1b5\ud574 \ud504\ub85c\uc138\uc2a4\uc758 \uad8c\ud55c\uacfc \uc790\uc6d0 \uc811\uadfc\uc744 \uc81c\ud55c\ud558\ub294 \ud30c\uc774\uc5b4\ud06c\ub798\ucee4\uc758 \uae30\ubcf8 \ubcf4\uc548 \uad6c\uc131 \uc694\uc18c\uc785\ub2c8\ub2e4.<\/p>\n<p>\uc5f0\uad6c\ud300\uc740 jailer\uac00 \ud65c\uc131\ud654\ub41c \ud504\ub85c\ub355\uc158 \ud658\uacbd\uc5d0\uc11c\ub294 \uacf5\uaca9\uc758 \uc601\ud5a5 \ubc94\uc704\uac00 \ud06c\uac8c \uc904\uc5b4\ub4e4 \uc218 \uc788\ub2e4\uace0 \uba85\uc2dc\ud588\uc2b5\ub2c8\ub2e4. \ud558\uc9c0\ub9cc \uc774\ub7ec\ud55c \uaca9\ub9ac \uc7a5\uce58\uac00 \uc2e4\uc81c\ub85c \uc5b4\ub5a4 \uc218\uc900\uc758 \ubcf4\ud638 \ud6a8\uacfc\ub97c \uc81c\uacf5\ud558\ub294\uc9c0\uc5d0 \ub300\ud55c \ubcc4\ub3c4\uc758 \ud3c9\uac00\ub294 \uc774\ubc88 \ubcf4\uace0\uc11c\uc5d0\uc11c \ub2e4\ub8e8\uc9c0 \uc54a\uc558\uc2b5\ub2c8\ub2e4.<\/p>\n<p>\uae30\uc220 \ucee4\ubba4\ub2c8\ud2f0\uc5d0\uc11c\ub294 \uc774 \ucde8\uc57d\uc810\uc774 \ud30c\uc774\uc5b4\ud06c\ub798\ucee4 \uc790\uccb4\uc758 \uacb0\ud568\uc778\uc9c0, \uc544\ub2c8\uba74 \uc774\ub97c \uc720\ubc1c\ud55c \ub9ac\ub205\uc2a4 \ucee4\ub110 \ub124\ud2b8\uc6cc\ud06c \uc2a4\ud0dd\uc758 \ubc84\uadf8\uc778\uc9c0\uc5d0 \ub300\ud55c \ub17c\uc758\uac00 \uc774\uc5b4\uc9c0\uace0 \uc788\uc2b5\ub2c8\ub2e4. \uc77c\ubd80 \uc804\ubb38\uac00\ub4e4\uc740 \uadfc\ubcf8 \uc6d0\uc778\uc774 \ucee4\ub110 \ub124\ud2b8\uc6cc\ud06c \ucf54\ub4dc\uc5d0 \uc788\uc73c\uba70, \ud30c\uc774\uc5b4\ud06c\ub798\ucee4\ub294 \ub2e8\uc21c\ud788 \uadf8 \uc601\ud5a5\uc744 \ubc1b\uc740 \ub300\uc0c1\uc774\ub77c\uace0 \uc9c0\uc801\ud558\uae30\ub3c4 \ud588\uc2b5\ub2c8\ub2e4.<\/p>\n<p>\ud604\uc7ac\uae4c\uc9c0 \ud655\uc778\ub41c \uc815\ubcf4\ub85c\ub294 CVE-2026-99999\ub85c \ucd94\uc801\ub418\ub294 \uc774 \uacf5\uaca9 \uccb4\uc778\uc774 jailer \uc5c6\uc774 \uad6c\uc131\ub41c \ud30c\uc774\uc5b4\ud06c\ub798\ucee4 \uc778\uc2a4\ud134\uc2a4\uc5d0\uc11c \ud638\uc2a4\ud2b8 \ub8e8\ud2b8 \uad8c\ud55c \ud68d\ub4dd\uc744 \uac00\ub2a5\ud558\uac8c \ud55c\ub2e4\ub294 \uc810\uc785\ub2c8\ub2e4. \uaca9\ub9ac \ud658\uacbd\uc5d0\uc11c\uc758 \ubc29\uc5b4\ub825 \uac80\uc99d\uc740 \ud5a5\ud6c4 \ucd94\uac00\uc801\uc778 \ubd84\uc11d\uc774 \ud544\uc694\ud55c \ubd80\ubd84\uc73c\ub85c \ub0a8\uc544 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>PWN \ub9ac\uc11c\uce58 \ud300\uc774 \ud30c\uc774\uc5b4\ud06c\ub798\ucee4 v1.16.1 \ud658\uacbd\uc5d0\uc11c \uac8c\uc2a4\ud2b8 VM \ub0b4\ubd80\uc758 \ucde8\uc57d\uc810\uc744 \uc774\uc6a9\ud574 \ud638\uc2a4\ud2b8 \uc2dc\uc2a4\ud15c\uc758 \ub8e8\ud2b8 \uad8c\ud55c\uc73c\ub85c \ucf54\ub4dc\ub97c \uc2e4\ud589\ud558\ub294 \ub370 \uc131\uacf5\ud588\ub2e4. \uc774 \uacf5\uaca9 \uccb4\uc778\uc740 KVM_RUN \uc2dc\uc2a4\ud15c \ud638\ucd9c \uc911 \uc800\uc7a5\ub41c \ub808\uc9c0\uc2a4\ud130\ub97c \uc870\uc791\ud574 VMM \ud504\ub85c\uc138\uc2a4\ub97c \ud0c8\ucde8\ud558\ub294 \ubc29\uc2dd\uc744 \uc0ac\uc6a9\ud588\uc73c\uba70, CVE-2026-99999\ub85c \uc2dd\ubcc4\ub418\uc5c8\ub2e4.<\/p>\n","protected":false},"author":3,"featured_media":49349,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jore2_quality_policy":"people-first-v2","footnotes":""},"categories":[405],"tags":[9694,80,32665,4241,32664],"class_list":["post-49350","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-405","tag-kvm","tag-vm","tag-32665","tag-4241","tag-32664"],"featured_image_urls":{"full":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/11\/news-23201-firecracker-vm-escape-pwnescape-part-2.png",1200,630,false],"thumbnail":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/11\/news-23201-firecracker-vm-escape-pwnescape-part-2-150x150.png",150,150,true],"medium":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/11\/news-23201-firecracker-vm-escape-pwnescape-part-2-300x158.png",300,158,true],"medium_large":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/11\/news-23201-firecracker-vm-escape-pwnescape-part-2-768x403.png",640,336,true],"large":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/11\/news-23201-firecracker-vm-escape-pwnescape-part-2-1024x538.png",640,336,true],"1536x1536":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/11\/news-23201-firecracker-vm-escape-pwnescape-part-2.png",1200,630,false],"2048x2048":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/11\/news-23201-firecracker-vm-escape-pwnescape-part-2.png",1200,630,false],"morenews-large":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/11\/news-23201-firecracker-vm-escape-pwnescape-part-2-825x575.png",825,575,true],"morenews-medium":["https:\/\/jore2.com\/wp-content\/uploads\/2026\/11\/news-23201-firecracker-vm-escape-pwnescape-part-2-590x410.png",590,410,true]},"author_info":{"info":["\ud55c\uc11c\uc900"]},"category_info":"<a href=\"https:\/\/jore2.com\/?cat=405\" rel=\"category\">\ub274\uc2a4<\/a>","tag_info":"\ub274\uc2a4","comment_count":"0","_links":{"self":[{"href":"https:\/\/jore2.com\/index.php?rest_route=\/wp\/v2\/posts\/49350","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jore2.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jore2.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jore2.com\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/jore2.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=49350"}],"version-history":[{"count":0,"href":"https:\/\/jore2.com\/index.php?rest_route=\/wp\/v2\/posts\/49350\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jore2.com\/index.php?rest_route=\/wp\/v2\/media\/49349"}],"wp:attachment":[{"href":"https:\/\/jore2.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=49350"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jore2.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=49350"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jore2.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=49350"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}