{"id":103363,"date":"2022-02-17T09:36:39","date_gmt":"2022-02-17T07:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-uvelichil-razmer-voznagrazhdenij-za-vyyavlenie-uyazvimostej-v-yadre-linux-i-kubernetes"},"modified":"2022-02-17T09:36:39","modified_gmt":"2022-02-17T07:36:39","slug":"google-uvelichil-razmer-voznagrazhdenij-za-vyyavlenie-uyazvimostej-v-yadre-linux-i-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/google-uvelichil-razmer-voznagrazhdenij-za-vyyavlenie-uyazvimostej-v-yadre-linux-i-kubernetes","title":{"rendered":"Google has increased the rewards for identifying vulnerabilities in the Linux and Kubernetes kernels.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Google has announced the expansion of its initiative to provide monetary rewards for identifying security issues in the Linux kernel, the Kubernetes container orchestration platform, the GKE (Google Kubernetes Engine), and the competition environment for vulnerability discovery kCTF (Kubernetes Capture the Flag). <\/p>\n
The reward program has introduced additional bonus payments of $20,000 for 0-day vulnerabilities, for exploits that do not require enabling user namespaces, and for demonstrating new exploitation methods. The base payment for demonstrating a working exploit in kCTF is $31,337 (the base payment is made to the participant who first demonstrates a working exploit, but bonus payments can also apply to subsequent exploits for the same vulnerability). <\/p>\n
Including bonuses, the maximum reward for a 1-day exploit (issues identified based on error correction analysis in the codebase, not explicitly marked as vulnerabilities) can reach up to $71,337 (was $31,337), and for a 0-day exploit (issues for which there is still no fix) \u2014 $91,337 (was $50,337). The payout program will be valid until December 31, 2022. <\/p>\n
It is noted that in the past three months, Google processed 9 reports containing information about vulnerabilities, for which $175,000 was paid. Participating researchers prepared five exploits for 0-day vulnerabilities and two for 1-day vulnerabilities. Information has been publicly disclosed for three already patched vulnerabilities in the Linux kernel (CVE-2021-4154 in cgroup-v1, CVE-2021-22600 in af_packet, and CVE-2022-0185 in VFS) (these issues had previously been identified through Syzkaller, and fixes were added for two of the issues in the kernel). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"