Google Online Security Blog: Trick & Treat! 🎃 Paying Leets and Sweets for Linux Kernel privescs and k8s escapes

126 captures

01 Nov 2021 - 24 Jul 2026

Jan	FEB	Mar
	14
2021	2022	2023

success

fail

About this capture

COLLECTED BY

Collection: Save Page Now

TIMESTAMPS

The Wayback Machine - https://web.archive.org/web/20220214175646/https://security.googleblog.com/2021/11/trick-treat-paying-leets-and-sweets-for.html

Security Blog

The latest news and insights from Google on security and safety on the Internet

Trick & Treat! 🎃 Paying Leets and Sweets for Linux Kernel privescs and k8s escapes

November 1, 2021

Posted by Eduardo Vela, Google Bug Hunters Team
Kubernetesresearch its vulnerabilities and attacksstudy and develop its defenseskCTF VRP

If the vulnerability was otherwise unpatched in the Kernel (0day)

If the exploit uses a new attack or technique, as determined by Google

Container-Optimized OS250,000 USD

Connect to the kCTF VRP cluster, obtain root and read the flag (read this writeup for how it was done before, and this threat model for inspiration), and then submit your flag and a checksum of your exploit in this form.

(If applicable) report vulnerabilities to upstream.

We strongly recommend including a patch since that could qualify for an additional reward from our Patch Reward Program, but please report vulnerabilities upstream promptly once you confirm they are exploitable.

Report your finding to Google VRP once all patches are publicly available (we don't want to receive details of unpatched vulnerabilities ahead of the public.)