Google Online Security Blog: Trick & Treat! 🎃 Paying Leets and Sweets for Linux Kernel privescs and k8s escapes

Trick & Treat! 🎃 Paying Leets and Sweets for Linux Kernel privescs and k8s escapes

1 ноември 2021 г.

Posted by Eduardo Vela, Google Bug Hunters Team
Kubernetesresearch its vulnerabilities and attacksstudy and develop its defenseskCTF VRP

If the vulnerability was otherwise unpatched in the Kernel (0day)

If the exploit uses a new attack or technique, as determined by Google

Container-Optimized OS250,000 USD

Connect to the kCTF VRP cluster, obtain root and read the flag (read this writeup for how it was done before, and this threat model for inspiration), and then submit your flag and a checksum of your exploit in this form.

(If applicable) report vulnerabilities to upstream.

We strongly recommend including a patch since that could qualify for an additional reward from our Patch Reward Program, but please report vulnerabilities upstream promptly once you confirm they are exploitable.

Report your finding to Google VRP once all patches are publicly available (we don't want to receive details of unpatched vulnerabilities ahead of the public.)

Provide the exploit code and the algorithm used to calculate the hash checksum.
A rough description of the exploit strategy is welcome.

#kctfhere

Няма коментари :

Публикуване на коментар

Security Blog

Trick & Treat! 🎃 Paying Leets and Sweets for Linux Kernel privescs and k8s escapes

Няма коментари :

Етикети

Archive

Feed