Someone Got There First

I found a real one in June, and it still came back a duplicate. This is about that, and about the part nobody writes down.

The bug was in NVIDIA’s container toolkit. There is a small hook that fixes up file permissions when a container starts, and it was the only one of its kind that still followed symlinks. Every other hook like it had been taught to resolve paths safely inside the container root. This one still called plain stat and plain chmod on a path I control, as root, before the container is sealed off from the host. So if I put a symlink in my own image and pointed it at a file on the host, the toolkit would chmod that host file for me.

I was careful about what I claimed. The mode is fixed at 0755, the hook is deprecated and off by default, and I only control where the symlink points, not the destination or the mode. I said all of that in the report because it is true, and because a report that oversells itself deserves to be closed. But it is still a root action that crosses out of the container and lands on the host, and it exists for one reason: one file never got the fix that all the others did.

I did not run it against anyone. I read the source at a specific commit until the shape of it bothered me, worked out the timing from the runtime spec that ships in the same repo, wrote up how it would work, and drew the fix before anyone asked for it. Then I sent it in.

Ten days later the status changed. Triage validated the finding. They raised the severity, which is not something you do to a report you think is wrong. And then they marked it a duplicate. Someone had filed the same thing first. Bounty, zero. Bonus, zero.

Here is the part people skip. It stings. Everyone in this field acts like they are above the sting and nobody is. It is not really about the money, or not only the money. You spend a weekend inside someone else’s code, you find the thing, you are honest about the limits, you write it like you respect the person on the other end, and then a field flips to Duplicate and on paper the whole weekend is worth nothing. There is no half credit for second. The report is right. It just does not count.

What surprised me was how fast the sting passed once I stopped arguing with it. Someone got there first. That happens, and it is not a referee making a bad call, it is just two people reading the same code and one of them being quicker to the form. I wrote back and said as much. I asked if acknowledgment was possible even for a duplicate, and since I had already sketched the fix, I offered to put up the pull request upstream if it would help. No demand, no appeal. The bug is real whether or not my name is on it.

The honest lesson is a boring one. Bug bounty pays for being first, not for being right, and you cannot pay rent on confirmed-but-second. I still love the work. I will still read source on a weekend and file the thing when I find it. But this is a large part of why I have stopped asking security to cover my rent and moved that job somewhere the math is kinder. The finding was good. The timing was not. Both of those can be true, and you learn more from the ones that pay nothing than from the ones that pay.

On to the next thing. This one taught me something, which is its own kind of bounty.