Our Experiences Participating in Microsoft’s Azure Sphere Bounty Program

McAfee Advanced Threat Research participated in the Microsoft Azure Sphere Research Challenge and identified multiple "important" and "critical" vulnerabilities—including application-package symlink misuse, inclusion of a character device enabling RCE, uid_map processing and azcore handling flaws enabling elevation-of-privilege, and improper certificate management allowing device re-claim—that together allowed a full exploit chain from a locked device to root. The issues were responsibly disclosed to Microsoft, resulted in significant bounty awards (to be donated to charities), and a detailed technical walkthrough was published.