sorona.xyz bug bounty programs
freebsd.org Updated
Sorona.xyz runs two public programs: a Sorona bug bounty paying up to $1,500 and a self-hosted disclosure program with no cash rewards.
- Top reward
- $1,500
- Sorona
- Programs
- 2
- 1 pays cash
- Targets in scope
- 18
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
bhyve
Sorona · Pays the most of the 2 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
bhyve
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | – | Open |
|
FreeBSD
Self-hosted · Disclosure only |
– | – | – | – | No cash | – | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
18 targets across all 2 programs, each listed once with the programs that cover it. 5 excluded.
-
bhyvectl and the control interfaces used to manage a running VM
Products and areas
Covered by Sorona
-
bhyveload, the UEFI firmware boot path and the boot ROM interaction
Products and areas
Covered by Sorona
-
Nested paging and guest memory mapping, including how guest physical memory is backed on the host
Products and areas
Covered by Sorona
-
Reports go to the FreeBSD Security Team, or PGP-encrypted to the Security Officer where confidentiality matters. The project publishes the criteria it applies to decide whether an issue warrants an advisory: privilege escalation, code injection, memory disclosure and remotely triggerable denial of service. bhyve sits in the base system, so the hypervisor and its userspace are both covered
Products and areas
Covered by Sorona
-
The bhyve userspace process and its complete emulated device model
Products and areas
Covered by Sorona
-
The emulated legacy and modern devices, including AHCI, NVMe, UART, HDA and the framebuffer
Products and areas
Covered by Sorona
-
The libvmmapi library that userspace consumers link against, including third-party managers
Products and areas
Covered by Sorona
-
The virtio devices: block, net, scsi, console, rng and the 9p filesystem device
Products and areas
Covered by Sorona
-
The vmm kernel module: VM lifecycle, VMX and SVM handling, and the ioctl interface it exposes to userspace
Products and areas
Covered by Sorona
-
The VNC and framebuffer server, which listens on the network on behalf of a guest console
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 5
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Guest operating system defects
Sorona
-
Jails, Capsicum and the other FreeBSD isolation mechanisms rather than bhyve
Sorona
-
Other parts of the FreeBSD base system unrelated to virtualization, which route through the same team but are a different target
Sorona
-
Third-party management wrappers such as vm-bhyve and iohyve
Sorona
-
TrueNAS or another downstream product's own code rather than base bhyve
Sorona
Recent changes
Reward and scope changes across every sorona.xyz program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in sorona.xyz products, from the NVD.
-
CVE-2026-58099 High
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these race
-
CVE-2026-58098 High
When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, th
-
CVE-2026-58100 High
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged l
-
CVE-2026-58098 High
When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is only 15 bits wide. If enough semaphore sets are created and destroyed in the same table slot while a caller is blocked, th
-
CVE-2026-58099 High
When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was dropped, the subsequent in-flux decrement operated on freed memory. An unprivileged local user may be able to exploit these race
-
CVE-2026-58100 High
kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged l
-
CVE-2026-101304 High
When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these techniques to escape the jail's filesystem root restriction.
-
CVE-2026-101305 High
renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. A jailed process could rename a directory relative to a restricted descriptor, then escape the jail root via fchdir(2). This requires the directory to reside on a filesystem that is also reachable from the jail's root. A process in a jail that has received a directory file descriptor from another jail can use these techniqu
About this page
This page gathers every public program listed under freebsd.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.