???????? ????? ???? ????? ???? ??????? Sandbox vm2 ?? ???? ???? ??? ?? ??? ??? ????? ???????? ?? ???????? ???? ???? ??? ?? ?????? ?????? ? ????? ?? ????? ?????? ???? ?????????? ???? ????.
??? ??? ?? ??? ??????? ?????? ? ??? ?? ?????? ?? ??? ????? ???? ??????? ???? ?????? ????????? KAIST WSP ????? ?? ??? ?????[?] ?? ? ????? ???? ????? ??[?] ? vm2 ?? ????? ??? ?? ?? ???? ?? ???? ?????? ?? ?? ??? ???? ????? ???[?].
vm2 ?? ?????? ??? ???[?]: «?? ???? ????? ???????? ????????? sandbox ?? ??? ???? ?? ???? ????? ?? ?? ??? ??? ?? ?? ??????? ?? sandbox ?? ???? ??????? ?? ??? ????».
?? ??? ?????????? ?? CVE-2023-29017 ?????? ????? ???[?] ? ?? ????? ????????? CVSS ????? ?????? ??? ???. ???? ?? ??? ?????? ???? ?????? ?? ??????? ?? ?? ?? ????? ????????? ?? ??????? ???????? ?????? ???????.
vm2 ?? ???????? ?????[?] ??? ?? ???? ????? ????? ?????????????? ?? ?? ???? ?????? ?? Node.js ??????? ??????. ????? ?? ???? ?????? ?????? ?? ???? ???? ? ?? ??? ????[?] ??????? ??????.
Seongil Wi? ???? ?????? KAIST? ?????? ?? ??? ????? ?? ?? ??????????[?] ????? ???? (PoC) ?? ???? CVE-2023-29017 ?? ????? ???? ???? ??? ?? ?????????? ???? ????? ?? ??? ?????? ? ????? ????? ?? ???? ???? ?? ??? «????» ?? ?? ?????? ??????.
??? ??????? ??????? ?? ??? ?? ?? ??? ????? ????? ????? (CVE-2022-36067? ????? ?????? ?? ?? ????? CVSS) ???? vm2 ???? ???????[?] ?? ????????? ???? ????? ??????? ?????? ??? ????? ???? ??????????? ???? ????.
?????
[?] https://wsp-lab.github.io/
[?] https://github.com/patriksimek/vm2/issues/515
[?] https://github.com/patriksimek/vm2/releases/tag/3.9.15
[?] https://github.com/advisories/GHSA-7jxr-cg7f-gpgv
[?] https://nvd.nist.gov/vuln/detail/CVE-2023-29017
[?] https://www.npmjs.com/package/vm2
[?] https://www.npmjs.com/package/vm2?activeTab=dependents
[?] https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d
[?] https://thehackernews.com/2022/10/researchers-detail-critical-rce-flaw.html
[??] https://thehackernews.com/2023/04/researchers-discover-critical-remote.html
???????
???? ??????
????
