Enjoy the Free Lunch, Someone Paid for Us: Escaping Resource Limits of MicroVM-based Containers

MicroVM-based containers are increasingly deployed in public clouds (e.g., AWS, Azure, and Alibaba Cloud) to combine container efficiency with strong isolation. However, we demonstrate that microVM-based architectures introduce a new class of resource accounting vulnerabilities which cause discrepancies between the physical resources consumed by a guest and the resource usage accounted by the host. To systematically uncover such issues, we propose a resource accounting analysis framework that examines accounting inconsistencies across both memory and storage subsystems. Using this framework, we identify three easily exploitable attack vectors: (i) writable memory accounting evasion via shared file-backed mappings, (ii) read-only memory accounting evasion via private file-backed mappings, and (iii) a storage accounting evasion that enables unbounded disk consumption through unmonitored file paths. We further combine these attack vectors into FREE (File-based Resource Expansion & Exploitation), a consolidated attack that freely inflates both memory and storage usage while evading associated resource accounting and billings. We also present a practical attack implementation capable of seamless integration into real-world applications, leveraging a custom dynamic shared library that transparently redirects standard allocations (e.g., malloc) to unaccounted file-backed mappings. We validate the feasibility of the FREE attack on MicroVM-based containers deployed in AWS, Azure and Alibaba Cloud, and use a billing evaluation model to quantify the economic profit of adversarial tenants. Our evaluation demonstrates that FREE can reduce the attacker's billed cost to 42.12% (Kata) and 41.93% (Firecracker) of the original payment. FREE can also be used to degrade the performance of co-located tenants, including up to 57.1% reduction in memory bandwidth and 67.06% loss in I/O throughput.