Intel-maintained open source

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical, CVSS 9.0-10.0 (Software, Tier 3: Firmware is Tier 2 and Hardware is Tier 1) │ Up to $10,000 │ Up to $11,000 High and Medium, CVSS 4.0-8.9 (Intel publishes Tier 3 as a range, not a per-band figure) │ $500 - $10,000 │ $625 - $11,000 Low, CVSS 0.1-3.9 │ $500 │ $625 Submit a vulnerability Latest advisories Loading the feed Overview Intel's solely-maintained open-source code sits under a large fraction of the world's server fleet: the TDX module underpins confidential computing on current Xeon platforms and on Azure and GCP confidential VMs, linux-sgx underpins enclave workloads, and Intel's Ethernet and graphics drivers ship in every mainstream Linux distribution. This is vendor code with kernel-adjacent privilege and cloud-scale deployment, and the 1,029 CVEs NVD holds against Intel software give the scale of the surface: the solely-maintained open-source subset is a minority of that and is not separately indexable, so no meaningful twelve-month figure exists for it alone. Intel pays through Intigriti, and open source lands in the Software tier (Tier 3) at $500 to $10,000; the $100,000 headline is Tier 1 silicon and never reachable from a repository. sorona.xyz adds 1.25× on top of whatever Intel awards, up to $1,000 more, plus a complexity bonus of up to $1,000. In scope Intel's own declaration on the live scope tab: Intel-branded products and technologies that Intel maintains and distributes are eligible, and inside that, open-source projects Intel solely maintains are in scope and go to the Intel Bug Bounty Program. Software is Tier 3 at $500 to $10,000. The silicon and system categories Intel lists by name: microprocessors including microcode ROM and updates, chipsets, FPGA components, networking and communication components, memory, motherboards and systems such as the Compute Stick and NUC, and solid-state drives UEFI BIOS, limited to the TianoCore components for which Intel is the only named maintainer, together with the Intel Management Engine and the Baseboard Management Controller Device drivers, applications and development tools, which is the category Intel's solely-maintained open-source repositories fall into: tdx-module, linux-sgx, ipp-crypto and intel-device-plugins-for-kubernetes are the representative cases Firmware published through the Intel Download Center, which Intel scores on Tier 2 rather than Tier 3 Hardware and silicon, scored on Tier 1, home of the $100,000 headline and out of reach of any repository-only finding Anything root-caused from a third-party product back into Intel-branded code, which Intel asks to be filed under the matching scope type Out of scope Third-party products, licensed first- and third-party products, pre-release products and divested businesses, all of which Intel marks "Bounty Eligibility: No" Products Intel has recently acquired, which stay out for at least six months after the acquisition completes End-of-life products, which earn reputation but no bounty Intel freeware applications, former McAfee products, Intel's IT infrastructure and the *.intel.com web estate, each of which routes to a different address rather than to the bounty Open and prototyping platforms, meaning products shipped deliberately "open" to give customers debugging capability Open-source projects Intel only contributes to, which belong with that project's own maintainers Submissions needing an attacker to physically open the case, which Intel's out-of-scope table records as open-chassis attacks Any testing that reaches another person's data, which Intel says disqualifies the report from award outright Intel's live out-of-scope table also lists Intel-maintained open-source projects as out of scope and sends reporters to the project maintainer, which contradicts the scope section admitting projects Intel solely maintains. Confirm eligibility with Intel before committing time. Most-valued findings Memory-safety defects in kernel-adjacent Intel code, drivers, the TDX module, enclave runtimes, where the privilege sitting behind the bug is what makes it worth the top of the ladder, and which account for 40% of the bug classes here Confidential-computing boundary failures in the TDX module or linux-sgx, where a host or a neighbouring tenant reaches inside a guest or an enclave Access-control flaws in Intel's platform tooling and Kubernetes device plugins that let a workload reach a device or a host resource it was never granted Side channels and information disclosure that leak keys or tenant data across a boundary Intel's documentation says holds A finding demonstrated on a supported release of a project you can show is solely maintained by Intel, since eligibility is decided before severity is Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Only projects Intel solely maintains are in scope: anything Intel merely contributes to is out, and Intel's instruction is to contact that project's maintainer directly instead Check the project's own SECURITY.md before reporting; Intel's programme tells researchers to "always refer to the project-specific Security.md file for details", and it is the evidence that the project routes to Intel Send the report to Intel first and discuss it with nobody Intel has not authorised Participation grants Intel a perpetual licence over the submission, so assume the material stops being yours to publish Intel's eligibility matrix rates open-source software as a "Maybe" for bounty rather than a "Yes", so argue eligibility in the report rather than assuming it Recent acquisitions are out for at least six months after the deal closes, and end-of-life products earn reputation only Disclosure Coordinated by Intel PSIRT, which triages, fixes and issues the CVE through Intel's own CNA and publishes the result as an INTEL-SA advisory with researcher credit. The programme is public and carries no NDA gate to join, but the non-disclosure clause on report contents runs until Intel gives written consent, so sorona.xyz holds the finding until Intel has published. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability