Qualcomm
Qualcomm: Intelligent Computing Everywhere
External Program
Submit bugs directly to this organization
Qualcomm
Qualcomm: Intelligent Computing Everywhere
External Program
Submit bugs directly to this organization
Qualcomm Technologies, Inc. (QTI) understands that maintaining a large variety of products comes with certain responsibilities.
We recognize that conducting security research often requires investing a large amount of time and skill in order to make an impact. We are lucky enough to work with a top-notch community and have had good experiences in the past when working with security researchers. We definitely appreciate the hard work and effort that external security researchers have put into researching and improving security within the mobile ecosystem. Subject to the following rules, we are sponsoring the following program to recognize individual research efforts.
At this time we only accept and reward vulnerabilities in Qualcomm products. If you would like to report an issue with Qualcomm infrastructure including the website please use the following mailing address: [email protected]
In order to maximize the effectiveness of our response processes and lower time spent on understanding the specific concern, we ask you to submit high quality reports, including a written description of the vulnerability, information on respective source code snippets or binary analysis, and proof-of-concept code or any other supporting material that helps assessing the vulnerability quickly and effectively. Reports must provide a convincing case for the security impact of the reported issue.
Good examples of such reports also usually include information about the affected devices and versions, description of issue impact and vulnerability type, description of an attack scenario, and instructions on reproducing the issue.
All eligible vulnerability submissions must be done through the HackerOne reporting tool. Please be aware that for the time being we do not accept software patches.
We are rewarding qualified vulnerability submissions in certain types of software running on specific hardware. Development platforms are excluded from qualifying devices/targets. The following is a current list of hardware and software components that qualify. From time to time, we may update this list.
Vulnerabilities affecting the following chipset families are in scope. We routinely accept vulnerabilities outside of this list. Please contact us for more information. Note some chipsets within the families may be EOL and not covered for reward, unless it affects a non-EOL supported product.
This page can help to identify commercial devices that make use of the Snapdragon chipsets.
Chipsets generally remain in scope for 3 years after Qualcomm begins customer deliveries. However, we also accept reports for chipsets after this date if the reporter can identify at least one OEM/device manufacturer that still actively supports a device that makes use of the chipset in question. We also usually reward critical- or high-rated reports for products of any age if there is reason to believe that the reported vulnerability impacts one or more devices within the 3 year window or that are still actively supported by the OEM/manufacturer.
The following is a list of software component categories which are eligible for rewards. Software must be present on the aforementioned devices in order to qualify. A valid report must mention at least one concrete commercial device.
We are currently rewarding vulnerabilities in the following software components:
In addition to eligible devices and targets, the following rules generally apply to all vulnerability submissions:
QTI retains ultimate discretion to determine the eligibility of a submission. In particular, we may decide to pay even more for unusually clever or severe vulnerabilities, decide that a single report actually constitutes multiple bugs, or that multiple reports are so closely related that they only warrant a single reward. Note that incomplete submissions, especially those lacking a PoC in the initial submission, may result in reward, credit, and CVE ID ineligibility.
Furthermore, we usually do not reward the following issues:
In case of issues that can be attributed to multiple parties or issues that cannot be attributed to QTI and its affiliates, we reserve the right to decide rewards on an individual case-by-case basis. In these cases, you may choose to accept our assistance with multi-party coordination (when we have the appropriate contacts) or you may attempt to contact the other parties directly after our determination.
The mobile ecosystem is based on a complex supply chain and attribution can be hard at times. First and foremost, this program is targeted towards rewarding vulnerabilities in code that we control and that we can address directly. This means we usually do not reward vulnerabilities in third-party components out of our control. On the other hand, we'd like to leverage any possibility that we can to improve the security of our devices and appropriately reward contributions where we can. If you are unsure about whether some particular component is within scope or not, please don't hesitate to ask us in advance. Please see our FAQ for more information.
We anticipate rewarding submissions according to the security impact reflected by our security ratings and the nature of the vulnerable software.
Active exploits are not required for vulnerability submissions. However, the quality of the vulnerability report such as whether the description is clear or not, other supporting material is workable, etc., will have impact on the rewards listed up to a 20% reduction. We also reserve the right to issue extra rewards for researchers who make outstanding effort in helping us address the vulnerability, or discover new classes of vulnerabilities or novel attacks.
Reports in certain areas must include a proof-of-concept (PoC that works in production environment is required with initial submission) to be considered for a reward. These areas are highlighted in the rewards breakdown below.
In rare exceptions, we reward vulnerabilities that are known to us already. This usually happens if the report identified further gaps that require follow-up on our end. We reserve the right to reward up to 50% of the listed amount in such cases on an individual basis at our sole discretion.
The below table is provided as a general guidance of our rewards per rating level. We recognize that there are corner cases which are not covered, for example the vulnerabilities in hardware. While we intend to apply the same rating rationale, we cannot make this a comprehensive list. Although we will try to abide by this list, the actual amount of a reward will be made at our sole discretion. Reward amounts are up to the listed maximum below.
Security Rating: Critical
TME/Secure Processor: $21,000
Software Category: Cellular modem - Reward: $15.000
Software Category: TEE - Reward: $9.000
Software Category: Bootloader - Reward: $9.000
Software Category: Application processor software and all other qualified components - Reward: $8.000
Security Rating: High
TME/Secure processor: $8,000
Software Category: Cellular modem - Reward: $5.000
Software Category: TEE - Reward: $5.000
Software Category: Bootloader - Reward: $5.000
HLOS Privileged service $2,000
Software Category: Application processor software and all other qualified components - PoC that works in production environment is required with initial submission - Reward: $4.000 *Drivers such as KGSL/FastRPC that do not have SELinux permissions for Unprivileged apps: Reward up to $10,000. Please note the Up-to we will try our best to pay out as much as we can for these reports, but they need to be high quality, show how exploitation would work.
Security Rating: Medium
HLOS Privileged service $1,000 ** PoC Required **
Software Category: All qualifying components - PoC that works in production environment is required with initial submission - Reward: $2.000 ** PoC Required **
Security Rating: Low
HLOS Privileged service: $200 ** PoC Required **
Software Category: All qualifying components - PoC that works in production environment is required with initial submission - Reward: $200-$1.000
Along with the rewards listed above we accept issues and will consider a bonus payment for the following items:
All researchers who qualified will become part of the QTI Product Security Hall of Fame or the CodeAuroraForum Hall of Fame, depending on the nature of the vulnerability.
Qualcomm values community engagement and has provided more than $330 million in donations since 2000, either directly or through the Qualcomm Foundation. In that spirit, we are pleased to announce that security researchers who participate in our Vulnerability Rewards Program can now choose to donate their reward to an eligible nonprofit organization of their choice, and Qualcomm will match that donation dollar for dollar. For program details, guidelines, and restrictions, please contact [email protected].
Unfortunately, we cannot authorize payments to citizens of countries that are on sanctions lists or who reside in such countries. This include for example Cuba, Iran, North Korea, Sudan, and Syria. Additionally, participants are responsible for any tax implications. Please also pay attention to additional restrictions that may apply due to local laws. By providing a submission, you are providing QTI and its affiliates permission to use such submission to improve our products. You agree not to provide any submission that is not entirely yours to provide to QTI. QTI reserves the right to terminate this program at any time.
2024/Jul/9th --Snapdragon X-Elite device reimbursement & extra rewards until October 1st (may extend).
2024-01-10 --FastRPC and KGSL related memory corruption bugs that are EXPLOITABLE will receive up to $10,000
2023-06-07 -- Added WoS into the program + campaign until September 2023
2022-11-14 -Modified the reward structure to add TME, and to differentiate HLOS Privileged components from Kernel components. Added notice of potential bonuses for specific areas. We will expand these bonus areas soon.
2022-01-11 -Clarified EOL devices, and added Snapdragon 888 and Series 8 Gen 1 as examples.
2021-11-03 -Gunyah Hypervisor is officially supported for rewards in the VRP.
2021-07-28
2021-4-23:
2020-06-19:
2020-01-08:
2020-01-07:
2019-08-29:
2019-05-21:
2019-04-23:
2019-04-10:
2019-02-25:
2018-11-06:
2018-11-01:
2018-10-17:
2018-09-26:
2018-09-21:
2018-06-26:
2018-04-04:
2018-03-01:
2017-12-13:
2017-09-26:
2017-06-08:
2017-06-07:
2017-06-01: