Google has announced a new bug bounty program with significant rewards for vulnerabilities found in the Kernel-based Virtual Machine hypervisor.
The goal of the new program, named kvmCTF, is to help find and address vulnerabilities in the KVM hypervisor.
The bug bounty program works like a CTF event, with participants being able to reserve time slots to access a guest VM hosted in a lab environment, and attempt to conduct a guest-to-host attack.
Google is hoping the project will help in identifying virtual machine escapes, arbitrary code execution flaws, information disclosure issues, and denial-of-service bugs.
The highest reward, $250,000, can be earned for a full VM escape.
Participants can earn $100,000 for an arbitrary memory write exploit, and $50,000 for an arbitrary memory read or a relative memory write exploit.
DoS attacks can earn up to $20,000 and relative memory read flaws up to $10,000.
KVM is widely used in both consumer and enterprise solutions, including by the Android and Google Cloud platforms, which is why the internet giant wants to enhance the hypervisor's security.
Interested hackers can read the complete rules for kvmCTF on GitHub.
This Cyber News was published on www.securityweek.com. Publication date: Mon, 01 Jul 2024 14:43:06 +0000