avatar
Bug bounty
Public

systemd Bug Bounty Program

Securing Open Source Ecosystem

Reward

Bounty
Hall of fame
€250
Low
€500
Medium
€3,000
High
€5,000
Critical
€10,000

Program

Avg reward
-
Max reward
-
Scopes
17

Supported languages
English

Hacktivity

Reports
2
1st response
< 1 day
Reports last 24h
-
Reports last week
-
Reports this month
2

Project

systemd is a suite of basic building blocks for a Linux system. It provides a system and service manager that runs as PID 1 and starts the rest of the system.

systemd provides aggressive parallelization capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, keeps track of processes using Linux control groups, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. systemd works as a replacement for SysV init.

Other parts include a logging daemon, utilities to control basic system configuration like the hostname, date, locale, maintain a list of logged-in users, running containers and virtual machines, system accounts, runtime directories and settings, and daemons to manage simple network configuration, network time synchronization, log forwarding, and name resolution.

This bug bounty program is paid for by the Bug Resilience Program.

Scopes

You can find our repositories on Github

Program Rules

  • We welcome external reviews by security researchers in order to identify bugs in our components.
  • The scope of this program only applies to the software we build, not to our CI infrastructure or our git/website hosting, and any such attack is prohibited.
  • Issues must be reproducible in our setup in order to be accepted as valid.
  • We operate this bounty program on a "One Fix One Reward" basis. We consider an issue duplicated if it was previously reported through other channels, and also if it affects a common code module and it was already reported for a different component.
  • The systemd project ships many tools and components, most of which are optional, and some of which are experimental. The scope of this program only applies to a select subset of such components, as defined later. This selection is subject to change in the future.
  • The systemd project ships many optional features that require root or admin privileges to enable. While bugs in disabled-by-default features are still eligible for the bounty program, the criticality will be lowered due to reduced impact.

Precautions

  • Do not include Personally Identifiable Information (PII) in your report and redact or obfuscate any PII that is part of your PoC (journald logs, screenshot, terminal captures, etc.).

Eligibility

Every valid report that helps us improve the security of the project is welcome, however, in order to qualify for monetary rewards the following eligibility requirements must be met at a minimum:

  • Source of the issue must be in the code published and developed on https://github.com/systemd/systemd (as opposed to a different repository in the same org, or a distribution-specific patch).
  • The vulnerability must be new and not have been reported before, here or elsewhere.
  • The vulnerability must meet the qualifying criteria as defined in the relevant section.
  • A reproducer (code and/or configuration and/or sequence of commands) must accompany the report, the issue must be clearly described, and the issue must be reproducible.
  • You must not be a maintainer of the systemd project.
  • Our analysis is always based on the worst impact demonstrated in your PoC
  • Only reports affecting the main branch of the project are eligible.

Rating and Responsible Disclosure

CVSS is used to rate and categorize vulnerabilities. Vulnerabilities will be publicly disclosed after sufficient time has passed and fixes have been backported where needed, if deemed necessary in coordination with mainstream Linux distributions.

Advisories will be published on the advisory page of our GitHub repository, and where deemed necessary as CVEs and on external mailing-lists like oss-security.

We handle the full disclosure process and expect submitters not to disclose any findings themselves. If requested, we will fully credit the reporters in the advisories.

The process for external reporting is described on GitHub


Reward

Asset value CVSS
Low
CVSS
Medium
CVSS
High
CVSS
Critical
High
€500€3,000€5,000€10,000
Medium
€250€1,500€2,500€5,000

Scopes

ScopeTypeAsset value
systemd (the manager itself) other
High
Low
€500
Medium
€3,000
High
€5,000
Critical
€10,000
systemd-boot other
High
Low
€500
Medium
€3,000
High
€5,000
Critical
€10,000
systemd-stub other
High
Low
€500
Medium
€3,000
High
€5,000
Critical
€10,000
systemd-udev other
High
Low
€500
Medium
€3,000
High
€5,000
Critical
€10,000
systemd-journald other
High
Low
€500
Medium
€3,000
High
€5,000
Critical
€10,000
systemd-logind other
High
Low
€500
Medium
€3,000
High
€5,000
Critical
€10,000
systemd-networkd other
High
Low
€500
Medium
€3,000
High
€5,000
Critical
€10,000
libsystemd other
High
Low
€500
Medium
€3,000
High
€5,000
Critical
€10,000
systemd-timesyncd other
Medium
Low
€250
Medium
€1,500
High
€2,500
Critical
€5,000
systemd-hostnamed other
Medium
Low
€250
Medium
€1,500
High
€2,500
Critical
€5,000
systemd-resolved other
Medium
Low
€250
Medium
€1,500
High
€2,500
Critical
€5,000
systemd-cryptenroll other
Medium
Low
€250
Medium
€1,500
High
€2,500
Critical
€5,000
systemd-cryptsetup other
Medium
Low
€250
Medium
€1,500
High
€2,500
Critical
€5,000
systemd-veritysetup other
Medium
Low
€250
Medium
€1,500
High
€2,500
Critical
€5,000
systemd-fstab-generator other
Medium
Low
€250
Medium
€1,500
High
€2,500
Critical
€5,000
systemd-gpt-auto-generator other
Medium
Low
€250
Medium
€1,500
High
€2,500
Critical
€5,000
systemd-ask-password other
Medium
Low
€250
Medium
€1,500
High
€2,500
Critical
€5,000

Out of scopes

  • journal sealing in systemd-journald: there are known issue that need to be solved first, before this feature can be included in the program
  • Anything related to https://systemd.io

Vulnerability types

Qualifying vulnerabilities

  • UEFI SecureBoot bypasses
  • Remote code execution
  • Remote denial of service
  • Local and unprivileged denial of service
  • Privilege escalation
  • Sandboxing bypass
  • Login prompt/password check bypass
  • Disk encryption keys leaks
  • Misuse of cryptographic primitives
  • Leaking user logs to other unprivileged users
  • Signed dm-verity compromise

Non-qualifying vulnerabilities

  • Everything not in the qualifying vulnerabilities list is not accepted by default, and might be considered solely at the discretion of the maintainers
  • Report on a purely hypothetical vulnerability containing no reproducible proof of concept
  • Issues only found in outdated versions of our software (i.e. not vulnerable on the HEAD of the main branch)
  • Issues found in external dependencies, including cryptographic backend libraries
  • Issues found by oss-fuzz or other upstream CI systems

Hunters collaboration

When submitting new report, you can add up to 5 collaborators, and define the reward split ratio.

For more information, see help center.
Note: For reports that have already been rewarded, it is not possible to redistribute the rewards.