Vulnerability in Patriksimek Vm2
CVE-2022-36067
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.479 (98.8th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.479 · newest: 0.479 · change: 0.000
Affected products
- Patriksimek Vm2 — versions < 3.9.11
- Vm2 Project
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq (Patch, Third Party Advisory)
- github.com/patriksimek/vm2/issues/467 (Third Party Advisory, Issue Tracking)
- github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873 (Patch, Third Party Advisory)
- github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js (Exploit, Third Party Advisory)
- www.oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067 (Exploit, Third Party Advisory)
- security.netapp.com/advisory/ntap-20221017-0002/ (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-36067?
- CVE-2022-36067 is a critical-severity vulnerability in Patriksimek Vm2, classified under Improper Control of Dynamically-Managed Code Resources. CVSS score: 10.0/10. Published 2022-09-06.
- How severe is CVE-2022-36067?
- Critical severity. CVSS v3 base score is 10.0 out of 10.
- Is CVE-2022-36067 known to be exploited?
- 10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.