Vercel subsequently described PwnEscape as the most severe finding submitted through its program. “The packet-related crash and code execution attacks were demonstrated on the researcher’s own KVM and Firecracker machines matching Vercel Sandbox configuration,” Vercel’s principal security engineer Andy Riancho said in a blog post. No reports showed anyone accessing customer data in Vercel Sandbox, he added.
The issue is now resolved. An NVD description of the bug identified seven stable-branch fixes, including Linux versions 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.2, and one mainline fix.
Delayed checksum changed kernel-trusted header
PwnEscape exploits Linux’s checksum-offloading mechanism, which allows the kernel to defer calculating a network packet’s checksum until a later stage of processing. The packet’s metadata specifies where the calculation should begin and where its result should be written.
