You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We invite you to demonstrate an exploit against our kCTF demo cluster based on the challenges presented on this page. Successful demonstrations are eligible for rewards between [20,000 - 91,337 USD](https://security.googleblog.com/2022/02/roses-are-red-violets-are-blue-giving.html) as defined in [https://g.co/vrp](https://g.co/vrp). On top of this, exploiting our [new instances](#experimental-mitigations-challenge) are eligible up to 42,000 USD, increasing the total possible payout to [133,337 USD](https://security.googleblog.com/2022/08/making-linux-kernel-exploit-cooking.html).
3
+
We invite you to demonstrate an exploit against our kCTF demo cluster based on the challenges presented on this page. Successful demonstrations which don't use Linux kernel vulnerabilities are eligible for rewards as described in our [kCTF VRP announcement blog post](https://security.googleblog.com/2020/05/expanding-our-work-with-open-source.html).
4
+
5
+
**Important note:** If you'd like to demonstrate an exploit against a Linux kernel vulnerability, please submit it to [our kernelCTF program](https://google.github.io/security-research/kernelctf/rules.html). **kCTF VRP does not accept Linux kernel vulnerabilities anymore** since 2023-06-14. For more information read our blog post "[Learnings from kCTF VRP's 42 Linux kernel exploits submissions](https://security.googleblog.com/2023/06/learnings-from-kctf-vrps-42-linux.html)".
4
6
5
7
[kCTF](https://github.com/google/kctf) is an open source infrastructure for CTF competitions. You can find details on how it works in the [kCTF documentation](https://google.github.io/kctf/introduction.html), but in short, it’s running on a hardened Kubernetes cluster with the following security features:
6
8
@@ -26,19 +28,19 @@ You can find the code for the challenges
26
28
27
29
The “kctf” challenge is the only entry point to the cluster. You can connect to it via:
It will ask you to solve a proof-of-work and then gives you access to a bash running in a setup similar to the [kCTF pwn template challenge](https://github.com/google/kctf/tree/beta/dist/challenge-templates/pwn). The only difference is that the flag is not accessible inside of the nsjail sandbox and you will need to break out of the chroot in order to read it. You can observe the full source code [here](https://github.com/google/google-ctf/tree/master/vrp).
40
42
41
-
The details of the kernel of the VM can be read from `/etc/node-os-release`, and you can get the image of the VM following [this script](https://gist.github.com/sirdarckcat/568934df2b33a125b0b0f42a5366df8c) based on the output of `/etc/node-os-release`.
43
+
The details of the environment of the VM can be read from `/etc/node-os-release`, and you can get the image of the VM following [this script](https://gist.github.com/sirdarckcat/568934df2b33a125b0b0f42a5366df8c) based on the output of `/etc/node-os-release`.
As you can see, the flags include a timestamp and are rotated frequently.
60
62
61
-
## Experimental mitigations challenge
62
-
63
-
We’re [launching new instances](https://security.googleblog.com/2022/08/making-linux-kernel-exploit-cooking.html) to evaluate the latest Linux kernel stable image as well as new experimental mitigations in a custom kernel we've built. Rather than simply learning about the current state of the stable kernels, the new instances are used to ask the community to help us evaluate the value of both our latest and more experimental security mitigations.
64
-
65
-
The [mitigations](https://github.com/thejh/linux/blob/slub-virtual/MITIGATION_README) we've built attempt to tackle the following exploit primitives:
66
-
* Out-of-bounds write on slab
67
-
* Cross-cache attacks
68
-
* Elastic objects
69
-
* Freelist corruption
70
-
71
-
You can connect to the instance with the latest kernel without the patch via
72
-
73
-
```
74
-
nc kctf-mitigation.vrp.ctfcompetition.com 1337
75
-
```
76
-
77
-
And to the version patched with our experimental mitigations:
78
-
79
-
```
80
-
nc kctf-mitigation.vrp.ctfcompetition.com 31337
81
-
```
82
-
83
-
(Previous kernel version 5.19 with the mitigation is available at `nc kctf-mitigation.vrp.ctfcompetition.com 31338`, but please do not use that for new research.)
84
-
85
-
These instances are not based on the kCTF infrastructure (as they require running custom kernel version), instead they spin up a new QEMU VM on every new connection. As this is not a production-ready infrastructure, breaking the infrastructure itself (or e.g. using leaks from console) is not considered a valid submission.
Please also note that although we are trying to keep up-to-date with the latest kernel version, these instances may sometimes be outdated.
97
-
98
63
### Submission
99
64
100
65
We want to avoid learning about unfixed vulnerabilities, so the process to submit reports is:
101
66
1. Test your exploit - we recommend you to test it locally first, and run a GKE cluster to debug.
102
-
2. If it is a 0day (there's no patch for it on [linus master branch](https://github.com/torvalds/linux/tree/master)yet), then send us a checksum of your working exploit to our form [here](https://docs.google.com/forms/d/e/1FAIpQLSeQf6aWmIIjtG4sbEKfgOBK0KL3zzeHCrsgA1EcPr-xsFAk7w/viewform). You won't share any technical details about the vulnerability, you will just record the fact you found something (as we only reward the first person that writes an exploit for a given bug, we use it to resolve the timing in case of an exploit collision). Make sure to submit the exploit checksum **before** there's a public patch and to submit the full exploit **within a week** after the patch is public. If you take longer than a week, we might issue the reward to someone else.
67
+
2. If it is a 0day (there's no patch for it yet), then send us a checksum of your working exploit to our form [here](https://docs.google.com/forms/d/e/1FAIpQLSeQf6aWmIIjtG4sbEKfgOBK0KL3zzeHCrsgA1EcPr-xsFAk7w/viewform). You won't share any technical details about the vulnerability, you will just record the fact you found something (as we only reward the first person that writes an exploit for a given bug, we use it to resolve the timing in case of an exploit collision). Make sure to submit the exploit checksum **before** there's a public patch and to submit the full exploit **within a week** after the patch is public. If you take longer than a week, we might issue the reward to someone else.
103
68
3. For 1days or once there is a public patch, test your exploit it on the [lab environment](#kctf-challenge). If you have troubles let us know in [#kctf](https://discord.gg/V8UqnZ6JBG) and we'll help you figure out any problems.
104
69
4. Once you get the flag, send it together with the patch and the exploit [here](https://docs.google.com/forms/d/e/1FAIpQLSeQf6aWmIIjtG4sbEKfgOBK0KL3zzeHCrsgA1EcPr-xsFAk7w/viewform).
105
70
5. To increase the timely sharing of new techniques with the community, we are also now requiring that the exploits that receive innovation bonus get publicly documented within a month, otherwise we may publish it.
106
71
107
72
### Notes
108
73
109
-
We want to encourage the community to help research vulnerabilities such as those [found by Syzkaller](https://syzkaller.appspot.com/upstream#open), but which are still unfixed since they have not been shown to be exploitable. As such:
110
-
111
-
74
+
We want to encourage the community to help research vulnerabilities, but which are still unfixed since they have not been shown to be exploitable. As such:
112
75
113
76
* The person that develops the exploit and receives the reward might not be the same as the person that discovered or patched the vulnerability.
114
77
* It's ok to use 1-day exploits against the lab environment using publicly known vulnerabilities that exploit the patch gap between the time when a patch is announced and the lab environment is updated, however we will only issue a single reward per vulnerability.
115
78
116
-
117
79
**When we receive an exploit for a fixed vulnerability we'll add details [here](https://docs.google.com/spreadsheets/d/e/2PACX-1vS1REdTA29OJftst8xN5B5x8iIUcxuK6bXdzF8G1UXCmRtoNsoQ9MbebdRdFnj6qZ0Yd7LwQfvYC2oF/pubhtml).**
118
80
119
81
In case of questions or suggestions, you can reach us in [#kctf](https://discord.gg/V8UqnZ6JBG).
0 commit comments