Document Owner/文件掌管人：
Rockchip Product Security Incident Response Team (PSIRT) / Rockchip 产品安全事务响应团队 (PSIRT)
Version /版本: V1.1.0
Published Date/颁布日期: 2026/8/17
Public Location /公开地位:
Classification /密级: Public /公开
1. Scope of Responsibilities / 职责领域
Rockchip Product Security Incident Response Team (PSIRT) is responsible for receiving, investigating, and disclosing the security vulnerability information related to Rockchip products and solutions. We encourage that professional researchers, organizations, government agencies, and vendors report relevant security vulnerabilities to Rockchip PSIRT
Rockchip 产品安全事务响应团队（PSIRT）掌管接管、调查和披露与 Rockchip 产品及解决规划有关的安全缝隙信息 。我们激励专业钻研人员、组织、当局机构和供给商实时向 Rockchip PSIRT 汇报有关安全缝隙 。
Policy scope / 战术合用领域
· Security incidents in hardware or software of Rockchip products / Rockchip 产品软硬件中的安全事务
· Defects in safety information or recommendations in Rockchip documents, e.g., datasheets and application notes / Rockchip 文档中的安全信息或建议缺点（如数据手册、利用笔记）
· Security-sensitive documents or security-related information found in places where they should not be provided / 在不应提供的场所发现的安全敏感文档或安全有关信息
· Security-sensitive Rockchip products found in places where they should not be provided / 在不应提供的场所发现的安全敏感 Rockchip 产品
Out of scope / 领域表内容
· Vulnerabilities in Rockchip IT systems, such as the website. Still, you can send the relevant information to PSIRT, which will be forwarded to the appropriate Rockchip teams. / Rockchip IT 系统中的缝隙（如网站） 。仍可将有关信息发送给 PSIRT ，我们会转交给相应团队 。
· Any other supports or events. E-mails regarding product support and other unrelated topics will not be responded by PSIRT. / 任何其他支持或事务 。关于产品支持及无关主题的邮件 ，PSIRT 不予回复 。
· Third-party services we do not operate / 我们不运营的第三方服务
· Findings that are already public / 已公开的发现
· Reports with no demonstrable security impact / 无法证明有安全影响的汇报
· Volumetric denial-of-service testing / 大流量回绝服务测试
· Social engineering of our staff or customers / 针对我们员工或客户的社会工程攻击
2. Process / 流程
Rockchip PSIRT Process / Rockchip PSIRT 流程
a) Detect vulnerabilities / 发现缝隙
To timely process security vulnerabilities, we must detect them in the first place. On the one hand, Rockchip encourages security researchers, organizations, customers, and vendors to report potential vulnerabilities to Rockchip PSIRT in a timely manner. On the other hand, Rockchip keeps monitoring well-known public vulnerability repositories, open-source communities, and security websites to detect vulnerabilities related to Rockchip products. When a potential vulnerability is reported to Rockchip PSIRT, PSIRT confirms the receipt of the report and notifies the appropriate technical team to analyze the vulnerability.
为实时处置安全缝隙 ，首先必须发现它们 。一方面 ，Rockchip 激励安全钻研人员、组织、客户和供给商实时向 Rockchip PSIRT 汇报潜在缝隙；另一方面 ，Rockchip 持续监控驰名公开缝隙库、开源社区和安全网站 ，以发现与 Rockchip 产品有关的缝隙 。当潜在缝隙汇报给 Rockchip PSIRT 时 ，PSIRT 确认收到汇报并通知相应技术团队进行分析 。
b) Analyze vulnerabilities / 分析缝隙
For any potential vulnerabilities reported to Rockchip PSIRT, the technical team analyzes them as soon as possible and confirm the validity and influence of the vulnerabilities; Rockchip uses the most popular Common Vulnerability Scoring System (CVSS) to analyze the severity of vulnerabilities.
针对汇报给 Rockchip PSIRT 的任何潜在缝隙 ，技术团队会尽快分析 ，确认其有效性和影响领域；Rockchip 选取通用缝隙评分系统 (CVSS) 评估缝隙严沉水平 。
c) Define solutions / 确定解决规划
Vulnerability severity levels are assessed based on the actual impact to determine the priorities according to which solutions are provided. Rockchip develops patches or updates software versions for the affected products, and conduct sufficient tests to ensure the effectiveness.
基于现实影响评估缝隙严沉等级 ，以确定解决规划优先级 。Rockchip 为受影响产品开发补丁或更新软件版本 ，并进行充分测试以确保有效性 。
d) Release solutions / 颁布解决规划
Rockchip releases the patches or software versions to customers, and notifies customers in the Security Advisory (SA) or software release notes, so that customers make risk policies accordingly.
Rockchip 向客户颁布补丁或软件版本 ，并通过安全布告 (SA) 或软件颁布注明通知客户 ，以便客户造订相应风险战术 。
e) Optimize solutions / 优化解决规划
Rockchip collects feedbacks from customers and optimizes the solutions when necessary. We will also continue to improve the vulnerability handling process.
Rockchip 网络客户反馈 ，在必要时优化解决规划 。我们也将持续改进缝隙处置流程 。
3. How to Report / 若何汇报
Potential security vulnerabilities can be reported by email: [psirt@rock-chips.com](mailto:psirt@rock-chips.com), or by telephone with 400-7700-590 for China mainland, 0086-591-83991906 Ext:8198 for oversea.
国表请拨打：0086-591-83991906 ，转8198
可通过电子邮件汇报潜在安全缝隙：[psirt@rock-chips.com](mailto:psirt@rock-chips.com) 或 全国统一客服热线：400-7700-590 ，国表请拨打：0086-591-83991906 ，转8198 。
Since vulnerability information is relatively sensitive, we strongly recommend that you use our [PGP Key](/uploads/240514/Rockchip_PSIRT_0xB12ADB4F_public.asc) when reporting security vulnerabilities to Rockchip PSIRT.
由于缝隙信息较为敏感 ，我们强烈建议在向 Rockchip PSIRT 汇报安全缝隙时使用TB888通宝 [PGP 密钥](/uploads/240514/Rockchip_PSIRT_0xB12ADB4F_public.asc) 。
Secure and anonymous reporting / 安全与匿名汇报
To protect sensitive vulnerability information while it is being exchanged: / 为在互换过程中；っ舾械姆煜缎畔ⅲ
Our web form is served over HTTPS. / TB888通宝网页表单通过 HTTPS 提供 。
You may encrypt email to us using our PGP key (fingerprint: 55B7 E7AE E8B8 D1DB 1ED2 7EB2 E180 A02D B12A DB4F), available from /uploads/240514/Rockchip_PSIRT_0xB12ADB4F_public.asc. / 您可使用TB888通宝 PGP 密钥（指纹：55B7 E7AE E8B8 D1DB 1ED2 7EB2 E180 A02D B12A DB4F）对发给TB888通宝邮件加密 ，公钥可从 /uploads/240514/Rockchip_PSIRT_0xB12ADB4F_public.asc 获取 。
You may report anonymously. If you would like a response, please give us a contact address or an alias. / 您能够匿名汇报 。若但愿得到回复 ，请提供联系地址或别号 。
We will still accept reports sent through less secure channels — please do not let the lack of encryption stop you from reporting. / 我们仍会接受通过较不安全渠路发送的汇报——请不要因短缺加密而烧毁汇报 。
What to include in your report / 汇报中应蕴含的内容
To help us validate and fix the issue quickly, please include as much of the following as you can: / 为援手我们急剧验证和建复问题 ，请尽可能蕴含以下内容：
Product identification — the affected product or service name, the affected version(s), and the platform or environment (OS, hardware) where applicable. / 产品标识——受影响的产品或服务名称、受影响版本 ，以及合用时的平台或环境（操作系统、硬件） 。
Vulnerability description — what the issue is and where it exists, and its type or class (e.g., buffer overflow, SQL injection, improper authentication). / 缝霞述——问题是什么、存在于何处 ，及其类型或类别（如缓冲区溢出、SQL 注入、不当鉴权） 。
Impact — the potential impact if the issue is exploited (confidentiality, integrity or availability), and a severity assessment or CVSS score if you have one. / 影响——问题被利用时的潜在影响（机密性、齐全性或可用性） ，以及严沉性评估或 CVSS 评分（如有） 。
Reproduction steps — step-by-step instructions to reproduce the issue, and proof-of-concept code or technical evidence if available. / 复现步骤——复现该问题的分步注明 ，以及概想验证代码或技术证据（如有） 。
Discovery information — the date you found the issue and how (testing method, tool, or accidental finding). / 发现信息——您发现问题的日期及方式（测试步骤、工具或无意发现） 。
Your contact information — your name or alias (you may remain anonymous) and a channel for follow-up. / 您的联系信息——您的姓名或别号（可匿名）以及用于后续跟进的渠路 。
Disclosure intent — whether you intend to publish your findings, and any date you are working toward. / 披露意向——您是否筹算公开发现 ，以及您争取的任何日期 。
4. Policies /战术
We are committed to providing safe, reliable, and innovative products for customers. In order to maximize the efficiency of analyzing, resolving, and disclosing security vulnerabilities, we urge you to comply with the following policies when you submit vulnerability reports.
我们致力于为客户提供安全、靠得住、创新的产品 。为最大化分析、解决和披露安全缝隙的效能 ，提交缝隙汇报时请遵守以下战术 。
Disclosure Policies / 披露战术
Security vulnerabilities must be related to defects in hardware or software of Rockchip products or in Rockchip documents regarding security information or recommendations (e.g., datasheets and application notes). /安全缝隙必须与 Rockchip 产品的软硬件缺点 ，或 Rockchip 文档中的安全信息/建议缺点（如数据手册、利用笔记）有关 。
Security issues are yet unknown to Rockchip and are only reported to Rockchip. /安全问题尚未为 Rockchip 所知 ，且仅向 Rockchip 汇报 。
All security information must be kept confidential before being disclosed. Limit access to non-public vulnerability information in accordance with the "need-to-know" principle./ 所有安全信息在披露前必须保密 。凭据“知情必要”准则来限度对非公开缝隙信息的接见 。
Invasion of privacy, disruption of the product ecology, and destruction or tampering of data are not allowed. /不得加害隐衷、粉碎产品生态、销毁或篡改数据 。
When different persons submit the same security issue, only the first one is listed in our security acknowledgement. /多人提交统一安全问题时 ，仅首位汇报者列入安全称谢 。
Security vulnerability submissions may be additionally restricted by applicable laws. /安全缝隙提交可能受合用司法额表限度 。
Your tests should not violate any laws, nor destroy or affect any data that does not belong to you. This policy is consistent with the general vulnerability disclosure practices. Any activities that violate laws or may result in the breach of legal obligations are not allowed. / 您的测试不得违反司法 ，不得销毁或影响非您所有的数据 。本战术与通用缝隙披露实际一致 。任何违法或可能导致违反司法使命的活动均不允许 。
Rockchip reserves the right to determine the eligibility of submissions. / Rockchip 保留决定提交资格的权势 。
What you can expect from us / 您可等待我们做到
After you submit a report, we will: / 提交汇报后 ，我们将：
acknowledge receipt within 3 business days and assign a tracking reference; / 3 个工作日内确认收到并分配跟踪编号（体式：RKVUL-YYYY-XXXXXX）；
aim to triage and validate your report within 14 business days, and contact you if we need more information; / 14 个工作日内实现分级与验证 ，如需更多信息将与您联系；
keep you informed of our progress at reasonable intervals (at least every 14 days); / 以合理距离（至少每 14 天）传递进展；
aim to deliver a resolution within 90 calendar days, depending on complexity and any third parties involved; / 90 个天然日内交付解决规划 ，视复杂度及所涉第三方而定可调整；
notify you when the vulnerability has been remediated, and may invite you to confirm that the fix resolves it. / 建复颁布时通知您 ，并可能约请您确认建复是否解决问题 。
Coordinated disclosure /协调披露
We follow a coordinated disclosure approach: /我们遵循协调披露准则：
We ask that you give us a reasonable opportunity to remediate the issue before disclosing it publicly. / 请您在公开披露前赐与我们合理的建复机遇 。
We will not publicly disclose details of a reported vulnerability before it has been addressed; any public disclosure will be coordinated and agreed between you and us. / 缝隙处置前不公开细节；任何公开披露将由双方协调并达成一致 。
Where appropriate we agree an embargo period. Embargo timelines can be adjusted case by case by mutual agreement, including where a coordinator or other vendors are involved. / 适当情况下约定禁披期 。禁披时限可经双方赞成逐案调整 ，蕴含涉及协调者或其他供给商时 。
When a fix is released, we publish a security advisory and, where appropriate, request a CVE identifier as an international standard identifier. / 建复颁布时 ，我们将颁布安全布告 ，并在适当情况下申请 CVE 编号（作为国际尺度标识） 。
Where to find our security advisories / 安全布告颁布渠路
When a vulnerability has been remediated, we publish a security advisory so that users can assess whether they are affected and how to update. You can find our advisories at: / 缝隙建复后我们将颁布安全布告 ，以便用户评估影响及更新方式 。布告颁布于：
Security advisory page: /a/en/Security/advisories. / 安全布告页面：/a/en/Security/advisories 。
Confidentiality and recognition /保密与称谢
We treat vulnerability reports as confidential. We will not share the personal information you provide with third parties without your explicit consent, except where required by law. / 我们将缝隙汇报视为机密 。未经您明确赞成 ，不与第三方共享您提供的幼我信息（司法要求之表） 。
With your permission, we are happy to credit you for your discovery in our advisory or on our acknowledgements page. Let us know if you would prefer to remain anonymous. / 经您许可 ，我们乐于在布告或称谢页面为您署名 。若您但愿匿名 ，请奉告我们 。
Safe harbour and good-faith research /安全港与善意钻研
If you make a good-faith effort to comply with this policy during your research, we will consider your research authorized, we will work with you to understand and resolve the issue quickly, and we will not pursue or support legal action against you. / 若您在钻研过程中善意遵守本战术 ，我们将视您的钻研为已授权 ，与您合作急剧理解和解决问题 ，不合您提起或支持司法诉讼 。
Good-faith research means, among other things, that you: /善意钻研尤其意味着您：
only interact with systems or accounts you own or have explicit permission to test; / 仅与您占有或获明确许可测试的系统或账户交互；
avoid privacy violations, destruction of data, and any degradation of our services (for example, no denial-of-service testing); / 预防加害隐衷、销毁数据、降低服务质量（如不进行回绝服务测试）；
access only the minimum data necessary to demonstrate the issue, and do not store, share or use it; / 仅接见证明问题所需的至少数据 ，不存储、共享或使用该数据；
give us a reasonable time to resolve the issue before any disclosure. / 在职何披露前赐与我们合理功夫解决问题 。
Note: Rockchip does not sell chips directly to end-users. Rockchip only sells chips to manufacturers and provides SDKs and materials to them, and the manufacturers develop the code provided by Rockchip based on their own requirements. Therefore, Rockchip does not provide technical support for end-users. If you have problems using Rockchip products, please contact the manufacturers for technical support. We would like to thank the individuals and teams who report valid vulnerabilities and work with us in responsible disclosure.
注：Rockchip 不直接向最终用户销售芯片 。Rockchip 仅向造作商销售芯片并提供 SDK 及资料 ，造作商基于自身需要开发 Rockchip 提供的代码 。因而 Rockchip 不为最终用户提供技术支持 。如您在使用 Rockchip 产品时遇到问题 ，请联系造作商追求技术支持 。感激汇报有效缝隙并与我们掌管任地合作披露的幼我和团队 。
[Thanks] will be given to the individuals and teams who report valid security vulnerabilities and cooperate with us during disclosure.
[称谢]将授予汇报有效安全缝隙并共同披露的幼我和团队 。
Policy changes /策略调换
We may update this policy from time to time. The current version and its publication date are shown in Document control above; material changes are recorded below. / 我们可能不断更新本战术 。当前版本及颁布日期见上方“文件节造”；沉大调换纪录于下方 。
Version/版本 | Changed by/调换人 | Date/日期 | Reason/调换原因 |
V1.0.0 | Rockchip PSIRT | 2024-05-14 | Initial version/初始版本 |
V1.1.0 | Rockchip PSIRT | 2026-08-17 | Added CRA/ISO 29147/30111 compliance per CVD template / 按 CVD 模板增长 CRA/ISO 29147/30111 合规内容 |
PGP KEY / PGP 密钥
Rockchip public [PGP Key](/uploads/240514/Rockchip_PSIRT_0xB12ADB4F_public.asc) for communication.
Rockchip 公开 [PGP 密钥](/uploads/240514/Rockchip_PSIRT_0xB12ADB4F_public.asc)供通讯使用 。
Because vulnerability information is relatively sensitive, we strongly recommend that you use our PGP public key (key ID: B12ADB4F; PGP fingerprint: 55B7 E7AE E8B8 D1DB 1ED2 7EB2 E180 A02D B12A DB4F) for encryption when reporting potential security vulnerabilities to Rockchip PSIRT.
由于缝隙信息较为敏感 ，我们强烈建议在向 Rockchip PSIRT 汇报潜在安全缝隙时使用TB888通宝 PGP 公钥（密钥 ID：B12ADB4F；PGP 指纹：55B7 E7AE E8B8 D1DB 1ED2 7EB2 E180 A02D B12A DB4F）进行加密 。
You can also copy the following PGP Key: [Rockchip public PGP Key](/uploads/240514/Rockchip_PSIRT_0xB12ADB4F_public.asc)
您也可直接复造以下 PGP 密钥：[Rockchip 公开 PGP 密钥](/uploads/240514/Rockchip_PSIRT_0xB12ADB4F_public.asc)
TB888通宝版权所有
闽ICP备19006074号-1 
闽公网安备 35010202001061号