Vercel has conducted a two-week security challenge that has uncovered numerous vulnerabilities in the Linux kernel networking stack that is used by its Firecracker microVM sandbox. This program, supported by a $1 million reward pool, examined researchers' abilities to break out of an environment that isolates untrusted artificial intelligence-agent code from other software. There were 1,285 vulnerability reports generated as a result of the challenge running from August 18 to September 1.
There have been about $325,000 in payouts to date for one critical, seven high-severity, 15 medium-severity, 49 low-severity and 19 informative findings validated by Vercel. Even though there were many submissions, none of them demonstrated access to actual customer data. Two separate flaws were found in the Linux kernel networking stack rather than Vercel's own sandbox code that were the most significant.
Various issues can lead to memory leaks from the host kernel, while others can cause a host system crash deterministically. It is particularly relevant to cloud environments since Linux kernel isolation layers are used by many infrastructure platforms. Therefore, a vulnerability that crosses the boundary between a microVM and its host may result in consequences that extend beyond a single deployment or service.
There were roughly two weeks before the Linux kernel maintainers were informed about the kernel issues, according to Vercel. Details remain undisclosed while fixes are in private review, with CVEs expected to be assigned after public disclosure. In addition to white-box testing, Trail of Bits engineers reported 20 findings after participating in the challenge.
The assessment did not only identify individual vulnerabilities but also highlighted architectural concerns related to the data movement between the host control plane and the guest environment. It was recommended that all values generated within the microVM be treated as untrusted guest input. Vercel acknowledged that certain values returned by software running within a guest had been accepted by its control plane, creating an architectural risk at the boundary of the sandbox.
AI-Assisted Triage Handles Report Surge
A separate challenge for Vercel was also presented during the two-week program: handling the staggering number of vulnerability reports generated. When 1,285 submissions were received within a short period of time, the original review process, involving a human assessment of each report, soon became challenging to scale.
Vercel developed the Eve framework as a means of implementing an agentic triage system.
Using Vercel Sandbox, the system can evaluate submitted reports against program rules, identify duplicates, access relevant source code, and execute researchers’ proof-of-concept code. This approach was implemented to alleviate the manual workload that was created by the unusually high number of submissions.
The volume itself was partly influenced by the challenge structure, which encouraged researchers to actively seek ways to avoid the sandbox boundaries.
As Vercel noted, the experience also demonstrated the effectiveness of AI-assisted security research in facilitating the discovery of new vulnerabilities more quickly.
The white box assessment, in addition to identifying technical vulnerabilities, also revealed architectural findings concerning the trust relationship between microVM guest hosts and control planes. According to the assessment, some values returned by software running inside a microVM were accepted by the control plane.
A Vercel representative stated that such values should not be treated as trusted data, but rather as tenant-controlled inputs. This company recommends obtaining sensitive values from the server end or encrypting them with cryptographic signatures with keys that cannot be accessed from the guest environment in order to protect them. According to the company, the findings have resulted in changes to the security controls and sandbox architecture.
While the Linux kernel issues remain under coordinated disclosure, technical details and CVE identifiers will be kept confidential until the fixes are published publicly. There was no evidence of customer data access as a result of the challenge, however, the kernel findings remain significant as the affected networking layer sits beneath isolation mechanisms in many cloud environments.
After patches are released and technical disclosures are made, the scope of affected systems will be determined and remediation requirements will be determined for Linux-based infrastructures.
Read the original article: