Vercel Sandbox Challenge Uncovers Linux Kernel Zero-Day and Pays $242,000 in Bounties

Vercel launched a $1M hacker challenge for Vercel Sandbox in August, coordinating with cybersecurity firm Trail of Bits to review source code and security architecture. Over two weeks, researchers submitted 1,285 reports, resulting in $242,000 in bounties paid out. The program uncovered one Linux kernel zero-day vulnerability, though no reports showed unauthorized access to customer data.

The Linux Kernel Zero-Day

The most critical finding, discovered by researcher Paulos Yibelo (pwn.ai) on day three, was a defect in the Linux kernel's networking stack. By sending specially crafted packets from within a microVM, the researcher demonstrated three attacks:

• Leak host memory: Memory from the host machine appeared in packets sent over the internet.
• Crash the host: Sending two specific packets shut down every sandbox on the machine.
• Execute code: The flaw allowed running commands with full administrator privileges on the host.

While the memory leak was demonstrated against Vercel production sandboxes, the crash and code execution attacks were verified on the researcher’s own KVM and Firecracker machines matching Vercel’s configuration. Vercel collaborated with AWS and kernel maintainers to mitigate the issue, with fixes currently under private review.

Internal and White-Box Findings

Beyond the public bounty, Vercel conducted internal assessments and engaged Trail of Bits for a four-week white-box deep dive. Trail of Bits delivered 20 findings and confirmed the virtualization boundary was sound, noting that each sandbox runs on its own Firecracker microVM with a dedicated guest kernel. They provided three structural recommendations, which Vercel implemented:

• Eliminate guest trust: Values returned by software inside the microVM are now derived server-side or signed.
• Centralize policy decisions: Egress enforcement now uses one canonicalization routine and one component per decision.
• Assume the next zero-day: Protections were strengthened by disabling nested virtualization and using Firecracker’s jailer to restrict permissions.

A notable internal finding by Vercel intern Marcos Hernanez identified a cross-tenant data leak in the Linux device-mapper storage layer, allowing sandboxes to read recycled disk blocks from previously deleted instances.

Cross-Tenant Disk Snapshot Restore

A public report filed on day one highlighted a trust-boundary violation in the snapshot control plane. The control plane trusted snapshot metadata ({storage_url, size, checksum}) provided by software running inside the guest. A researcher exploited this by intercepting and rewriting the snapshot response to swap storage objects between two accounts they owned, allowing one account to read and modify the other’s files.

The attack required knowing the victim’s internal snapshot storage key, a random 96-bit identifier not exposed via the API, meaning no path existed for a stranger to target another tenant. However, Vercel treated it as a priority fix. The control plane now binds every snapshot object to the creating project and moves snapshot creation to a host-side service with strictly validated URLs.