The Linux kernel is a key part for the safety of the Web. Google makes use of Linux in nearly every part, from the computer systems our workers use, to the merchandise folks world wide use day by day like Chromebooks, Android on telephones, automobiles, and TVs, and workloads on Google Cloud. Due to this, we have now closely invested in Linux’s safety – and immediately, we’re saying how we’re constructing on these investments and growing our rewards.
In 2020, we an open-source Kubernetes-based Seize-the-Flag (CTF) mission referred to as, . The kCTF lets researchers connect with our situations, and if they will hack it, they get a flag, and are probably rewarded. All of GKE and its dependencies are in scope, however each flag caught up to now has been a container breakout by way of a Linux kernel vulnerability. We’ve discovered that discovering and exploiting heap reminiscence corruption vulnerabilities within the Linux kernel might be made so much tougher. Sadly, safety mitigations are sometimes onerous to quantify, nonetheless, we expect we’ve discovered a manner to take action concretely going ahead.
Once we launched kCTF, we hoped to construct a neighborhood of Linux kernel exploitation hackers. This labored effectively and allowed the neighborhood to a number of members of the safety neighborhood like , , , , slipper@pangu, valis, , .
Now, we’re making updates to the kCTF program. First, we’re indefinitely extending the elevated reward quantities we earlier this yr, that means we’ll proceed to pay $20,000 – $91,337 USD for vulnerabilities on our lab kCTF deployment to reward the necessary work being executed to know and enhance kernel safety. That is along with our present for proactive safety enhancements.
Second, we’re launching with further rewards to guage the newest Linux kernel steady picture in addition to new experimental mitigations in a customized kernel we have constructed. Reasonably than merely studying in regards to the present state of the steady kernels, the brand new situations will likely be used to ask the neighborhood to assist us consider the worth of each our newest and extra experimental safety mitigations.
As we speak, we’re beginning with a set of mitigations we consider will make a lot of the vulnerabilities (9/10 vulns and 10/13 exploits) we obtained this previous yr harder to take advantage of. For brand new exploits of vulnerabilities submitted which additionally compromise the newest Linux kernel, we pays a further $21,000 USD. For these which compromise our customized Linux kernel with our experimental mitigations, the reward will likely be one other $21,000 USD (if they’re clearly bypassing the mitigations we’re testing). This brings the full rewards as much as a most of $133,337 USD. We hope this may enable us to be taught extra about how onerous (or straightforward) it’s to bypass our experimental mitigations.
The we have constructed try to sort out the next exploit primitives:
With the kCTF VRP program, we’re constructing a pipeline to research, experiment, measure and construct safety mitigations to make the Linux kernel as secure as we are able to with the assistance of the safety neighborhood. We hope that, over time, we can make safety mitigations that make exploitation of Linux kernel vulnerabilities as onerous as attainable.