Vercel discloses Linux kernel flaw enabling sandbox escape

Vercel disclosed a Linux kernel networking flaw that a researcher used to leak host memory from production sandboxes. The company said specially crafted packets also enabled host crashes and administrator-level code execution on the researcher's own machines configured to match Vercel Sandbox. The finding came from a security challenge launched in August. Vercel said it worked with the researcher, AWS and other partners to mitigate the vulnerability. Kernel fixes remain under private review, with CVEs pending. Vercel said no reports demonstrated access to customer files, secrets or application data. The production demonstration involved memory leakage; the crash and code-execution demonstrations used the researcher's KVM and Firecracker machines.