Intel Slim Bootloader

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical, CVSS 9.0-10.0 (Intel Software tier; Intel does not publicly classify this repo under the $30,000 Firmware tier) │ Up to $10,000 │ Up to $11,000 High and Medium, CVSS 4.0-8.9 (Intel publishes the Software tier as a whole, not a per-band figure) │ $500 - $10,000 │ $625 - $11,000 Low, CVSS 0.1-3.9 │ $500 │ $625 Submit a vulnerability CVE history 2 Last 12 months 3 Lifetime Memory safety 35 % Parsing/validation 30 % Auth bypass 20 % Access control 10 % Latest advisories Loading the feed Overview Slim Bootloader is Intel's open-source alternative to a full UEFI BIOS for embedded, IoT and edge x86 designs, built for fast minimal boot on Apollo Lake, Elkhart Lake, Alder Lake-N and comparable parts. It is the boot layer beneath Linux, Zephyr and ACRN payloads in industrial PCs, digital signage, kiosks, edge gateways, in-vehicle infotainment heads and automotive telematics boxes. Its installed base is smaller than coreboot or EDK II but it holds the same trust position, and a bug here is a pre-OS, persistent compromise sitting beneath every OS-level defence: no CVE has ever been issued against the repo, which makes this a low-CVE, high-consequence target rather than a quiet one. Intel pays for it on Intigriti under the Software tier, where a critical finding reaches up to $10,000 and the floor is $500, and sorona.xyz adds 1.25× on top of whatever Intel awards, up to $1,000 more, plus a complexity bonus of up to $1,000. In scope Intel's published line is that open-source projects it solely maintains are in scope and route to the Intel Bug Bounty Program. Slim Bootloader passes that test on all three counts Intel names: the organisation is Intel's, the licence reads Copyright Intel Corporation, and the repository SECURITY.md sends reporters to Intel's vulnerability-handling guidelines. Software is Tier 3 at $500 to $10,000. The whole boot flow: Stage1A, Stage1B, Stage2 and the payload launch path Verified boot, image signature verification and the key handling behind both The firmware update and capsule path The BootloaderCommonPkg and BootloaderCorePkg libraries and parsers, together with the EDK II MdePkg code vendored into the tree Configuration data (CFGDATA) parsing and the board-configuration and image-stitching tools in the repository that produce a flash image The Intel FSP (IntelFsp2Pkg) integration boundary, where data crosses between the silicon-init blob and bootloader code Payload interfaces and handoff structures for every payload the tree ships, covering the UEFI payload, the Linux payload and the OS loader Out of scope Anything requiring physical access: Intel puts out of scope "submissions that require an attacker to physically open the case, including removing screws or breaking plastic casing (open chassis)", and separately excludes firmware weaknesses that need physical access or a UEFI shell Pre-release, beta and release-candidate versions, which are never bounty-eligible End-of-life and discontinued products, licensed first- and third-party products such as Intel NUC-specific BIOS and software, and divested products, of which Intel names McAfee, Wind River, BlueZ and Altera Findings that only reproduce on a prototyping or debug-enabled platform, since Intel puts products "intended for prototyping use or that are 'open' to provide customers with debugging capability" out of scope for bounty rewards Duplicates of a finding Intel already holds, credential exposure and social engineering Intel's own IT infrastructure and the *.intel.com web estate, which belong to a different reporting channel Intel's live out-of-scope table on Intigriti lists Intel-maintained open-source projects as out of scope and sends reporters to the project maintainer, which contradicts the scope section admitting projects Intel solely maintains. Confirm eligibility with Intel before committing time. Most-valued findings Verified-boot or signature-verification bypass that gets unsigned code running before the OS loads: the finding that reaches the top of the ladder, because it defeats the entire point of the component Memory-safety defects in the Stage1 and Stage2 parsers reachable from data an attacker can place on the boot path, the single largest bug class here at 35% Capsule-update flaws that make a pre-OS compromise survive an OS reinstall CFGDATA or FSP-boundary parsing bugs that turn platform configuration data into control of execution Any of the above demonstrated on a production configuration rather than a development board with debug hooks still enabled Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Send the report to Intel first: the programme requires that the report and any accompanying material reach Intel before anyone else Intel's confidentiality obligation is indefinite and participation grants Intel a perpetual licence over the submission One CVE equals one bounty, so a single root cause reached through several entry points is paid once Severity is scored with CVSS 4.0, and the award follows the band the score lands in Demonstrate the bug against a production configuration on a currently supported public release; Slim Bootloader targets development boards, and Intel puts prototyping and debug-enabled platforms out of scope Disclosure Coordinated entirely by Intel PSIRT, which triages the report and issues a CVE through Intel's own CNA. Intel recognises awarded researchers in an Intel Security Advisory at or after public disclosure, but the gag on the reporter is indefinite, so publication timing is Intel's call and sorona.xyz holds the finding until Intel has shipped a fix. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability