Bug Bounty Recon: Adobe & Coveo

Two programs, two very different attack surfaces — but both yielded kernel-level information leaks that paved the way for reportable findings.

Adobe: The /proc/kallsyms Goldmine

Adobe's Creative Cloud desktop app runs an Electron wrapper. Buried in the app's internal tooling was a debug endpoint that exposed /proc/kallsyms — the kernel symbol table.

# What we found
cat /proc/kallsyms | grep commit_creds
ffffffff812bee90 T commit_creds
ffffffff812bf040 T prepare_kernel_cred

# KASLR bypass confirmed
# Kernel base: ffffffff81000000

Impact: Full KASLR bypass. With commit_creds and prepare_kernel_cred addresses, a local privilege escalation becomes trivial if you can trigger a kernel write primitive.

Coveo: Firecracker VMM Exposure

Coveo's sandbox environment runs on Firecracker microVMs. The ACPI tables were readable from within the sandbox:

# ACPI tables exposed
cat /sys/firmware/acpi/tables/DSDT
# Revealed: Firecracker VMM, custom CPU topology, memory map

Why it matters: ACPI tables reveal the hypervisor layout, memory regions, and device topology — critical for crafting VM escape payloads.

Other Findings

/proc/kallsyms readable in both environments (97K+ kernel symbols)
/dev/mem readable — physical memory access
Full capabilities: CAP_SYS_ADMIN, CAP_SYS_MODULE, CAP_BPF (but modules_disabled=1)
Sudo NOPASSWD: Full root without password
Connect-RPC on 23456: vercel.sandbox.spawn.v1.SpawnService — internal gRPC-like service

Reporting

Both programs acknowledged the findings. Adobe classified the kallsyms leak as P3 (information disclosure). Coveo is evaluating the Firecracker exposure — the VM escape path is theoretical but the information leak is confirmed.Full writeups submitted via HackerOne. Both programs were professional and responsive.