Vercel published findings from its hacker challenge for Vercel Sandbox, revealing that security researchers submitted 1,285 reports and uncovered a Linux kernel zero-day vulnerability. The company paid out $242,000 in bug bounties during the two-week program.
Kernel Zero-Day and Other Findings
Paulos Yibelo, a HackerOne researcher, discovered a defect in the Linux kernel's networking stack that allowed specially crafted packets to leak host memory, crash the host machine, and execute code on the host. Vercel stated that no reports showed anyone accessing customer data in Vercel Sandbox.
In addition to external submissions, a Vercel intern discovered a cross-tenant data leak in the Linux device-mapper storage layer. Another researcher found a cross-tenant disk snapshot restore flaw involving a trust-boundary violation, which Vercel stated was fixed within a week.
Trail of Bits Security Review
Cybersecurity firm Trail of Bits spent four engineer-weeks reviewing Vercel Sandbox's source code and security architecture, delivering 20 findings. Trail of Bits concluded that the virtualization boundary is sound, with each sandbox running on its own Firecracker microVM with a dedicated guest kernel.
The firm provided three structural recommendations, which Vercel implemented: eliminating trust in the guest, standardizing network policy enforcement to use one decider, and strengthening host-level protections to assume the next zero day.
Bounty Triage and Fixes
Vercel received 1,285 reports over two weeks, consisting of 877 duplicates, 319 not applicable reports, 57 valid reports, and 32 informative reports. The triage resulted in 1 critical finding, 5 high findings, 9 medium findings, 42 low findings, and 32 informative findings.
Vercel worked with AWS and other industry partners to prioritize a fix for the Linux kernel defect. Because fixes are under private review and CVEs are pending, the company did not publish additional technical details.
Key facts and where they come from
- Vercel paid out $242,000 in bug bounties during the challenge.
$242,000 in bounties paid out
- Paulos Yibelo discovered a defect in the Linux kernel's networking stack.
Paulos discovered that specially crafted packets sent from within the microVM enabled three different attacks
- Trail of Bits delivered 20 findings during its code and architecture review.
They delivered 20 findings, and each was tested, confirmed, and referenced to the exact code.
- Vercel received 1,285 reports over the course of two weeks.
1,285 reports over two weeks
