CVE-2023-29017: vm2 Sandbox Escape vulnerability
A flaw was found in vm2 where the component was not properly handling asynchronous errors. This flaw allows a remote, unauthenticated attacker to escape the restrictions of the sandbox and execute code on the host.
Other sources
https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv
— Red Hat
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to Error.prepareStackTrace in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-29017?
CVE-2023-29017 has been classified with a severity rating that indicates it poses a security risk due to improper handling of asynchronous errors.
How do I fix CVE-2023-29017?
To fix CVE-2023-29017, upgrade the vm2 package to version 3.9.15 or later.
Who is affected by CVE-2023-29017?
CVE-2023-29017 affects users of the vm2 package prior to version 3.9.15.
What components are vulnerable in CVE-2023-29017?
CVE-2023-29017 specifically impacts the vm2 package due to its improper handling of asynchronous errors.
Is CVE-2023-29017 a remote exploit?
Yes, CVE-2023-29017 can be exploited remotely, allowing unauthenticated attackers to potentially exploit the flaw.