Findings from the $1M Vercel Sandbox challenge
Vercel’s $1M Sandbox challenge uncovered a Linux kernel zero-day allowing sandbox escapes, prompting immediate fixes and broader security upgrades across shared cloud infrastructure.
In August, Vercel launched a $1M hacker challenge for Vercel Sandbox, inviting security researchers to test its isolation mechanisms. Coordinated with Trail of Bits, the program received 1,285 reports in two weeks, with no evidence of unauthorized access to customer data. The most severe finding was a defect in the upstream Linux kernel’s networking stack, enabling attacks that could expose host memory or crash shared infrastructure.
Paulos Yibelo, a HackerOne researcher, discovered that specially crafted packets sent from a microVM could leak host memory or compromise the host machine. The attacks included crashing the host and executing privileged commands, demonstrated on researcher-controlled KVM and Firecracker setups matching Vercel’s configuration. The flaw posed a shared-infrastructure risk, as major cloud providers rely on the same kernel layer for workload isolation.
Vercel collaborated with the researcher, AWS, and kernel maintainers to mitigate the vulnerability, with fixes under private review and CVEs pending. The company also conducted internal assessments and engaged Trail of Bits for a four-week code review, resulting in 20 findings, including a cross-tenant data leak in the Linux device-mapper storage layer found by an intern.
Vercel implemented structural changes to strengthen sandbox protections, including disabling nested virtualization, updating host kernels, and using Firecracker’s jailer to restrict microVM permissions. The company also revised egress enforcement policies to ensure consistent network policy enforcement and prevent trust in guest input, reinforcing the virtualization boundary.