Marios Pomonis, a Software Engineer at Google, announced the launch of kvmCTF, a vulnerability reward program for the Kernel-based Virtual Machine (KVM) hypervisor. KVM is a widely used open-source hypervisor that has been in development for over 15 years and is essential for platforms like Android and Google Cloud. Google is an active contributor to the KVM project and aims to identify and address vulnerabilities through the kvmCTF program.The kvmCTF program offers a lab environment where participants can log in and use their exploits to obtain flags. Unlike kernelCTF, kvmCTF focuses on zero-day vulnerabilities, and participants will not be rewarded for using n-day vulnerabilities. After an upstream patch is released, details about the zero-day vulnerability will be shared with Google, ensuring that the company receives the information at the same time as the rest of the open-source community.The kvmCTF environment consists of a bare metal host running a single guest VM. Participants can reserve time slots to access the guest VM and attempt to perform a guest-to-host attack. The goal is to exploit a zero-day vulnerability in the KVM subsystem of the host kernel. If successful, the attacker will obtain a flag proving their accomplishment. The severity of the attack determines the reward amount, with different tiers based on the type of exploit.Rewards range from $10,000 for relative memory read to $250,000 for a full VM escape. To facilitate the relative memory write/read tiers and denial of service, kvmCTF offers the option of using a host with KASAN enabled. Triggering a KASAN violation allows participants to obtain a flag as proof.To participate in kvmCTF, start by reading the program's rules. This will provide information on how to reserve a time slot, connect to the guest, obtain flags, and report vulnerabilities. Participants can also contact the team on Discord for further assistance.