CVE-2026-47213

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. In versions 0.8.2 and prior, Boxlite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, Boxlite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, Boxlite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the Boxlite service. This issue has been patched via commit 28159fc.

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. In versions 0.8.2 and prior, Boxlite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, Boxlite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, Boxlite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the Boxlite service. This issue has been patched via commit 28159fc.

Summary

BoxLite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI containers within them. BoxLite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, BoxLite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, BoxLite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the BoxLite service.

Details

1. ExecRequest with timeout_ms arrives at Execution service

File: guest/src/service/exec/mod.rs Function: spawn_execution() (line 315) Code:

// Step 3: Start timeout watcher (if requested)
if req.timeout_ms > 0 {
    timeout::start_timeout_watcher(
        state,
        execution_id.clone(),
        std::time::Duration::from_millis(req.timeout_ms),
    );
}

Issue: Any nonzero timeout_ms triggers the timeout watcher. The host expects this to kill the process after the specified duration.

2. Timeout watcher sends SIGALRM instead of SIGKILL

File: guest/src/service/exec/timeout.rs Function: start_timeout_watcher() (line 13) Code:

pub(super) fn start_timeout_watcher(
    exec_state: ExecutionState,
    exec_id: String,
    timeout: Duration,
) {
    tokio::spawn(async move {
        tokio::time::sleep(timeout).await;

        // Kill process with SIGKILL        ← comment says SIGKILL
        use nix::sys::signal::Signal;
        if exec_state.kill(Signal::SIGALRM).await {   // ← but sends SIGALRM
            info!(execution_id = %exec_id, "killed on timeout");
        }
    });
}

Issue: The comment on line 21 explicitly states "Kill process with SIGKILL", but line 23 sends Signal::SIGALRM. SIGALRM (signal 14) is the POSIX alarm signal and is catchable/ignorable; SIGKILL (signal 9) cannot be caught or ignored. This is a code error — wrong signal constant used.

3. exec_state.kill() passes the signal through unchanged

File: guest/src/service/exec/state.rs Function: kill() (line 325) Code:

pub async fn kill(&self, signal: nix::sys::signal::Signal) -> bool {
    let inner = self.inner.lock().await;
    if let Some(ref handle) = inner.handle {
        handle.kill(signal).is_ok()
    } else {
        false
    }
}

Issue: No override of the signal — the wrong signal (SIGALRM) is delivered directly to the process.

4. ExecHandle.kill() delivers SIGALRM to the process

File: guest/src/service/exec/exec_handle.rs Function: kill() (line 335) Code:

pub fn kill(&self, signal: Signal) -> BoxliteResult<()> {
    use nix::sys::signal::kill;
    kill(self.pid, signal).map_err(|e| {
        BoxliteError::Internal(format!(
            "Failed to send signal {} to process {}: {}",
            signal, self.pid, e
        ))
    })
}

Issue: Sends SIGALRM (signal 14) to the process. Any process that has registered a custom SIGALRM handler (e.g., via signal(SIGALRM, handler)) or set SIGALRM to SIG_IGN will not be terminated.

As seen from the code, the developer indicated in the comments that SIGKILL should be sent to kill the timed-out process, but SIGALRM was used in the implementation, resulting in the vulnerability.

PoC

1. Install Boxlite following the official tutorial.

2. Run the following Python script:

   #!/usr/bin/env python3
   """
   PoC: BoxLite Execution Timeout Bypass via SIGALRM
   
   Reproduces the vulnerability described in:
     "Hunt Report: Exec Timeout Enforcement Bypass via SIGALRM Misuse"
   
   Root cause:
     guest/src/service/exec/timeout.rs sends Signal::SIGALRM (signal 14,
     catchable/ignorable) instead of Signal::SIGKILL (signal 9, uncatchable).
   
   Exploitation:
     Any process that…
   

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. In versions 0.8.2 and prior, Boxlite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, Boxlite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, Boxlite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the Boxlite service. This issue has been patched via commit 28159fc.

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. In versions 0.8.2 and prior, Boxlite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, Boxlite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, Boxlite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the Boxlite service. This issue has been patched via commit 28159fc.

Summary

BoxLite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI containers within them. BoxLite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, BoxLite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, BoxLite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the BoxLite service.

Details

1. ExecRequest with timeout_ms arrives at Execution service

File: guest/src/service/exec/mod.rs Function: spawn_execution() (line 315) Code:

// Step 3: Start timeout watcher (if requested)
if req.timeout_ms > 0 {
    timeout::start_timeout_watcher(
        state,
        execution_id.clone(),
        std::time::Duration::from_millis(req.timeout_ms),
    );
}

Issue: Any nonzero timeout_ms triggers the timeout watcher. The host expects this to kill the process after the specified duration.

2. Timeout watcher sends SIGALRM instead of SIGKILL

File: guest/src/service/exec/timeout.rs Function: start_timeout_watcher() (line 13) Code:

pub(super) fn start_timeout_watcher(
    exec_state: ExecutionState,
    exec_id: String,
    timeout: Duration,
) {
    tokio::spawn(async move {
        tokio::time::sleep(timeout).await;

        // Kill process with SIGKILL        ← comment says SIGKILL
        use nix::sys::signal::Signal;
        if exec_state.kill(Signal::SIGALRM).await {   // ← but sends SIGALRM
            info!(execution_id = %exec_id, "killed on timeout");
        }
    });
}

Issue: The comment on line 21 explicitly states "Kill process with SIGKILL", but line 23 sends Signal::SIGALRM. SIGALRM (signal 14) is the POSIX alarm signal and is catchable/ignorable; SIGKILL (signal 9) cannot be caught or ignored. This is a code error — wrong signal constant used.

3. exec_state.kill() passes the signal through unchanged

File: guest/src/service/exec/state.rs Function: kill() (line 325) Code:

pub async fn kill(&self, signal: nix::sys::signal::Signal) -> bool {
    let inner = self.inner.lock().await;
    if let Some(ref handle) = inner.handle {
        handle.kill(signal).is_ok()
    } else {
        false
    }
}

Issue: No override of the signal — the wrong signal (SIGALRM) is delivered directly to the process.

4. ExecHandle.kill() delivers SIGALRM to the process

File: guest/src/service/exec/exec_handle.rs Function: kill() (line 335) Code:

pub fn kill(&self, signal: Signal) -> BoxliteResult<()> {
    use nix::sys::signal::kill;
    kill(self.pid, signal).map_err(|e| {
        BoxliteError::Internal(format!(
            "Failed to send signal {} to process {}: {}",
            signal, self.pid, e
        ))
    })
}

Issue: Sends SIGALRM (signal 14) to the process. Any process that has registered a custom SIGALRM handler (e.g., via signal(SIGALRM, handler)) or set SIGALRM to SIG_IGN will not be terminated.

As seen from the code, the developer indicated in the comments that SIGKILL should be sent to kill the timed-out process, but SIGALRM was used in the implementation, resulting in the vulnerability.

PoC

1. Install Boxlite following the official tutorial.

2. Run the following Python script:

   #!/usr/bin/env python3
   """
   PoC: BoxLite Execution Timeout Bypass via SIGALRM
   
   Reproduces the vulnerability described in:
     "Hunt Report: Exec Timeout Enforcement Bypass via SIGALRM Misuse"
   
   Root cause:
     guest/src/service/exec/timeout.rs sends Signal::SIGALRM (signal 14,
     catchable/ignorable) instead of Signal::SIGKILL (signal 9, uncatchable).
   
   Exploitation:
     Any process that…
   

Summary

BoxLite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI containers within them. BoxLite allows users to configure a timeout for services running inside the virtual machine. When the timeout is triggered, BoxLite sends a signal to kill the process. However, instead of using the uncatchable SIGKILL signal, BoxLite uses the catchable SIGALRM signal. Malicious code running inside the sandbox can exploit this vulnerability to continue running after the timeout is triggered, leading to resource exhaustion within the virtual machine and affecting the availability of the BoxLite service.

Details

1. ExecRequest with timeout_ms arrives at Execution service

File: guest/src/service/exec/mod.rs Function: spawn_execution() (line 315) Code:

// Step 3: Start timeout watcher (if requested)
if req.timeout_ms > 0 {
    timeout::start_timeout_watcher(
        state,
        execution_id.clone(),
        std::time::Duration::from_millis(req.timeout_ms),
    );
}

Issue: Any nonzero timeout_ms triggers the timeout watcher. The host expects this to kill the process after the specified duration.

2. Timeout watcher sends SIGALRM instead of SIGKILL

File: guest/src/service/exec/timeout.rs Function: start_timeout_watcher() (line 13) Code:

pub(super) fn start_timeout_watcher(
    exec_state: ExecutionState,
    exec_id: String,
    timeout: Duration,
) {
    tokio::spawn(async move {
        tokio::time::sleep(timeout).await;

        // Kill process with SIGKILL        ← comment says SIGKILL
        use nix::sys::signal::Signal;
        if exec_state.kill(Signal::SIGALRM).await {   // ← but sends SIGALRM
            info!(execution_id = %exec_id, "killed on timeout");
        }
    });
}

Issue: The comment on line 21 explicitly states "Kill process with SIGKILL", but line 23 sends Signal::SIGALRM. SIGALRM (signal 14) is the POSIX alarm signal and is catchable/ignorable; SIGKILL (signal 9) cannot be caught or ignored. This is a code error — wrong signal constant used.

3. exec_state.kill() passes the signal through unchanged

File: guest/src/service/exec/state.rs Function: kill() (line 325) Code:

pub async fn kill(&self, signal: nix::sys::signal::Signal) -> bool {
    let inner = self.inner.lock().await;
    if let Some(ref handle) = inner.handle {
        handle.kill(signal).is_ok()
    } else {
        false
    }
}

Issue: No override of the signal — the wrong signal (SIGALRM) is delivered directly to the process.

4. ExecHandle.kill() delivers SIGALRM to the process

File: guest/src/service/exec/exec_handle.rs Function: kill() (line 335) Code:

pub fn kill(&self, signal: Signal) -> BoxliteResult<()> {
    use nix::sys::signal::kill;
    kill(self.pid, signal).map_err(|e| {
        BoxliteError::Internal(format!(
            "Failed to send signal {} to process {}: {}",
            signal, self.pid, e
        ))
    })
}

Issue: Sends SIGALRM (signal 14) to the process. Any process that has registered a custom SIGALRM handler (e.g., via signal(SIGALRM, handler)) or set SIGALRM to SIG_IGN will not be terminated.

As seen from the code, the developer indicated in the comments that SIGKILL should be sent to kill the timed-out process, but SIGALRM was used in the implementation, resulting in the vulnerability.

PoC

1. Install Boxlite following the official tutorial.

2. Run the following Python script:

   #!/usr/bin/env python3
   """
   PoC: BoxLite Execution Timeout Bypass via SIGALRM
   
   Reproduces the vulnerability described in:
     "Hunt Report: Exec Timeout Enforcement Bypass via SIGALRM Misuse"
   
   Root cause:
     guest/src/service/exec/timeout.rs sends Signal::SIGALRM (signal 14,
     catchable/ignorable) instead of Signal::SIGKILL (signal 9, uncatchable).
   
   Exploitation:
     Any process that…