Astra Linux Special Edition 1.8.6

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz High (top band; no critical tier is defined for this programme) │ RUB 150,000 - RUB 250,000 │ RUB 150,000 - RUB 250,000 Medium │ RUB 50,000 - RUB 150,000 │ RUB 50,000 - RUB 150,000 Low (no minimum published) │ up to RUB 50,000 │ up to RUB 50,000 Submit a vulnerability Latest advisories Loading the feed Overview Astra Linux Special Edition is Russia's certified secure operating system: a Debian 12 package base with a repository of more than twenty thousand GPL, LGPL and BSD-family packages, wrapped in a proprietary certified distribution and deployed across Russian government and defence estates. What this programme actually buys is narrower than the distribution. The scope is the operating system's protection mechanisms, mandatory access control and the closed software environment, tested on a virtual machine the programme supplies rather than against a website, which is why the open-source share here is only partial: the tested surface is Astra's proprietary layer sitting on an open-source base. BI.ZONE prices it in roubles on three bands with no critical tier defined at all: up to RUB 50,000 at Low, RUB 50,000 to RUB 150,000 at Medium and RUB 150,000 to RUB 250,000 at High. The programme's own public API records RUB 2,730,000 paid across 26 resolved reports, an average of RUB 105,000, so it does pay. The prices were last modified in October 2024 while the rules moved in July 2026, so read the current rules on the programme page before you plan around either. sorona.xyz adds 1.25× on top of whatever the programme awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope What the programme names as its target is the operating system's protection mechanisms, mandatory access control and the closed software environment, tested against a research virtual machine the programme supplies rather than against a website. The ladder runs Low, Medium and High, with no critical tier defined at all Mandatory access control end to end: the kernel enforcement, the policy and label configuration, and the userspace tooling that sets it. Any path letting a subject read, write or execute across a label the system is certified to hold sits inside this The closed software environment: signature verification, the execution restrictions deciding what is permitted to run at all, and the paths that install or update what the system trusts The rest of the operating system as it ships on the supplied image, insofar as a defect there defeats one of those mechanisms: the kernel, the system services that start with it, and the privileged and setuid binaries the distribution installs The Debian 12 base and its repository of more than twenty thousand packages, insofar as a defect there reaches Astra's protection layer. The open-source share of this target is partial and the certified layer above it is proprietary Out of scope Hosted websites and services. The programme is scoped to the operating system on a supplied virtual machine rather than to a web target A critical band. The programme defines Low, Medium and High only, so RUB 250,000 is the top of the ladder rather than a rung below something bigger Upstream Debian and upstream package defects with no demonstrated effect on Astra's protection mechanisms, which are what the programme names Anything outside the supplied research image, including other Astra products such as ALD Pro, which BI.ZONE runs as a separate programme with its own grid Most-valued findings Mandatory access control bypass: reading, writing or executing across a security label the system is certified to enforce. It is the mechanism Astra Linux SE exists to provide, and it is what the High band at RUB 150,000 to RUB 250,000 is priced for. Escape from the closed software environment, getting unsigned or unapproved code to execute on a system whose entire configuration is meant to make that impossible Local privilege escalation to root that survives the mandatory-access-control layer, since on this distribution reaching root is explicitly not supposed to be the end of the story Integrity-control failures where a protected file, policy or label can be modified by a subject that should never be able to reach it Defects in the Debian-derived base that the certified layer was supposed to contain and does not: the case where the open-source lineage and the proprietary protection mechanisms disagree about what is permitted Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Testing is done on the research virtual-machine image the programme supplies: this is a code-under-test programme, not a website programme, so there is no live target to point a scanner at The ladder tops out at High: no critical tier is defined for this programme, so RUB 250,000 is the top of the ladder rather than a band below a bigger one There is no submission fee, but the reward figures were last modified on 2024-10-01 while the rules changed on 2026-07-23: read the current rules on the programme page before you start File with BI.ZONE directly and send the finding nowhere else until the programme confirms you are clear to publish Disclosure Coordinated through BI.ZONE, which takes the report and passes it to the vendor. Hold the detail until the programme confirms a fix has shipped and you are clear to publish. The full terms sit behind the platform's login, so read them inside your account before you publish anything. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability