$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws
Vercel's $1M sandbox challenge surfaced two Linux kernel networking defects—one leaking host kernel memory, one crashing hosts—with CVEs pending.
Vercel ran a two-week, $1 million sandbox escape challenge (Aug 18–Sep 1) on its Firecracker-based microVM sandbox, receiving 1,285 reports and committing ~$325k in payouts (1 Critical, 7 High, 15 Medium, 49 Low validated so far). No attacker accessed real customer data. The most important filing found two independent Linux kernel networking stack defects—one leaks host kernel memory, the other deterministically crashes the host—with wide implications for cloud providers isolating workloads via the same kernel layer. Fixes are under private review with CVEs pending; Vercel also plans to open-source its agentic report-triage agent built on the Eve framework running Kimi K3.
- 1,285 reports in two weeks; ~$325k committed payouts; no customer data accessed
- Two Linux kernel networking defects leak host kernel memory and crash hosts deterministically
- Flaws implicate major cloud providers isolating workloads via the same kernel layer
- Vercel learned of flaws two weeks before kernel maintainers; fixes under private review
- Agentic triage built on Eve framework and Kimi K3 to be open-sourced
From the original article
3 min read at securityweek.com
AI-assisted researchers flooded Vercel with reports, forcing the company to automate vulnerability triage. The post $1 Million Sandbox Challenge Uncovers Linux Kernel Flaws appeared first on SecurityWeek.
By Kevin Townsend · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.