Unexpected Page Fault In Virtualized Environment Advisory

Re:Unexpected Page Fault In Virtualized Environment Advisory by rossmohax on Tuesday December 10, 2019 @05:00PM (#21757323)

Intel now runs bug bounty program with up to $100k payouts (https://www.intel.com/content/www/us/en/security-center/bug-...), where one of the requirements is not to leak vulnerability details.

[ Parent | on HN ]

Re:Unexpected Page Fault In Virtualized Environment Advisory by cortesoft on Tuesday December 10, 2019 @05:04PM (#21757365)

Isn't that a pretty standard bug bounty requirement? The idea is that you submit the bug to the company and they fix it before it is disclosed.

[ Parent | on HN ]

Re:Unexpected Page Fault In Virtualized Environment Advisory by throwawaymath on Tuesday December 10, 2019 @05:43PM (#21757691)

It is standard in the sense that it's not uncommon. But about as frequently it's not a requirement. Many companies allow complete or partial vulnerability disclosure once resolution is complete. It's often on a case by case basis and requires approval.

[ Parent | on HN ]

Re:Unexpected Page Fault In Virtualized Environment Advisory by cortesoft on Tuesday December 10, 2019 @07:03PM (#21758176)

Oh, I thought that was what you meant (until resolution).. didn't realize they block disclosure forever

[ Parent | on HN ]