Google will pay between $20,000 and $91,337 to researchers who create exploits of vulnerabilities in the Linux kernel, the Kubernetes container management system, and Google Cloud’s Kubernetes Engine.
This builds on the three-month bounty Google introduced in November, where it tripled rewards for exploits against new and previously unknown Linux kernel bugs. The idea was that the crowd would uncover new kernel exploitation techniques, for services running on Kubernetes in the cloud in particular.
Researchers needed to show they could use the exploit for a given bug to compromise Google’s kCTF (Kubernetes Capture The Flag) cluster and obtain a ‘flag’ — a secret hidden in a program — within the context of a competition, which in this case was held on Google’s cluster.
Google considered the expanded program a success, and so it will extend it to at least the end of 2022. But it has also made a number of changes, covering rules, conditions and rewards.
First, the updated and extended program increases the maximum reward for a single exploit from $50,337 to $91,377.
On the success side of the existing trial, Google said it received nine submissions in the three months and paid out over $175,000 in rewards. The submissions included five zero-days or previously unknown flaws and two exploits for ‘1days’ or just discovered flaws. Three have been fixed and made public, including CVE-2021-4154, CVE-2021-22600 (patch) and CVE-2022-0185 (writeup), according to Google.
Google is changing the reward structure “slightly”. It will now pay $31,337 “to the first valid exploit submission for a given vulnerability” and will pay nothing for duplicate exploits.
However, it says some bonuses may still apply to duplicate exploits. These include: $20,000 for exploits for 0day vulnerabilities; $20,000 for exploits for vulnerabilities that do not require unprivileged user namespaces (CLONE_NEWUSER); and $20,000 for exploits using novel exploit techniques (previously it paid nothing for these).
“These changes increase some 1day exploits to 71,337 USD (up from 31,337 USD), and makes it so that the maximum reward for a single exploit is 91,337 USD (up from 50,337 USD),” Google notes.
On what it considers novel techniques, Google explains it’s for “powerful” offerings:
“[N]ovel technique could be the exploitation of previously unknown objects to transform a limited primitive into a more powerful one, such as an arbitrary/out-of-bounds read/write or arbitrary free. For example, in all our submissions, researchers leveraged message queues to achieve kernel information leaks.
“We are looking for similarly powerful techniques that allow heap exploits to be ‘plugged in’ and immediately allow kernel access. Another example is bypassing a common security mitigation or a technique for exploiting a class of vulnerabilities more reliably.”
This Linux kernel exploitation bug bounty is a small part of Google’s overall Vulnerability Reward Programs covering Android, Chrome and other open-source projects. In 2021, Google paid out $8.7 million in rewards, $2.9 million of which was for Android bugs and $3.3 million for Chrome bugs. Last year’s total rewards rose from $6.7 million in 2020.
