From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id 3yg1Deiqz2qCzAkAWB0awg (envelope-from ) for ; Wed, 14 Oct 2026 12:16:40 -0400 Authentication-Results: simark.ca; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=aw2URO1H; dkim-atps=neutral Received: by simark.ca (Postfix, from userid 112) id 1928B1E050; Wed, 14 Oct 2026 12:16:40 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-6.4 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham autolearn_force=no version=4.0.1 Received: from vm01.sourceware.org (vm01.sourceware.org [IPv6:2620:52:6:3111::32]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id 84D8C1E04E for ; Wed, 14 Oct 2026 12:16:39 -0400 (EDT) Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 5F1AA4BA23DE for ; Wed, 14 Oct 2026 16:16:38 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 5F1AA4BA23DE Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=aw2URO1H Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTP id 84FEF4BA2E14 for ; Wed, 14 Oct 2026 16:16:13 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 84FEF4BA2E14 Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 84FEF4BA2E14 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1791994573; cv=none; b=OC4/uRfStIAWGWqnU55C8DHifNHYApJTWW+i/PFQPWsi0Nm3C2m+n+eaHOFQ/85vFYjda+qE/+Gfo3EIheQtzDdO+qNYFX5axmc1wdNtovX3BwCDMRlJJL41mcSLRRUqgyrCTBndwBDxQ5QKVciMEAKVw0P8obfAzBMZyQkEfNs= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1791994573; c=relaxed/simple; bh=aZnQgEa26o5K2GQlSKHj+8vzS/IJnSi05vSA89irgQA=; h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From; b=bfpFGRKi6HIfDyqyv0bL5J+/CHHA1W2PaRvbqJw5iJ2904+mSqygrftB5XfaFy8LPhPe+6HBPnqoMvFvN+0X5cp0kVVi1lPRtd2YXH8oIYkA5sUb5B0FSsYyCTFEWuDA/VvGiXYgik1Wpv8+3Oh0ypqXG+qIN/Tka/zwpyhlGh4= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=aw2URO1H DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 84FEF4BA2E14 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1791994573; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=i3drlaTG5l5CLlOMQG6Fd1WgeHDIZ75zge6mx8IOvME=; b=aw2URO1HyuIiTwqNiXiBfw6d3Gn7diHGqhMpQj58SR0zOJJFBXGqsB48vRNFexoQ+HGlO3 8UC8LEc1JmkK/ms5vkrX679H8aLCpoc8YWODQs6osz5mKmoVW3AHYaUTi5zQKKnO8iOzRN E7ODaFd7hJ8gZPSSrc0GqEOAbHyJjuw= Received: from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-368-LQjNhj2SOYStnIc_kRlh8A-1; Wed, 14 Oct 2026 16:16:10 +0000 X-MC-Unique: LQjNhj2SOYStnIc_kRlh8A-1 X-Mimecast-MFC-AGG-ID: LQjNhj2SOYStnIc_kRlh8A_1791994570 Received: by mail-qt1-f199.google.com with SMTP id d75a77b69052e-53522c265f1so97053101cf.1 for ; Wed, 14 Oct 2026 09:16:10 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791994570; x=1792599370; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=i3drlaTG5l5CLlOMQG6Fd1WgeHDIZ75zge6mx8IOvME=; b=GZM7WoneHt7YErjTuvDcs4GNdzceW/9YXwPsXlDhq/A0Lv7rx1RpiASihQEX9BMxJ3 kRcAjOrMLTFytFQt+605NkYOziIJnMGONwgM5bOkUZfQKRjjByWpzRkA7VG73HOx6+Id lEUTbe7xJhB//IWKBm99WQmy74XToRvvtUqPgIBlIhg9kvA0mNyFKSx48zSMgD3Ukr72 Ob/1Rr64SWilZffbGKu7Ay8Hk0B+jYC10Obsi0qPlGviZ4y6i444RxyNZAOCl+6XsX0Z e7cwpIZsfUe+owlYyOsEQ+0hZDnrLqMNIB2O7yO7hln2wojrcqhYxQ6Aqvl0DlJAFVtP y0NQ== X-Forwarded-Encrypted: i=1; AKwUvBxTqsw+5Q5DxYCZPiX7oC0KNIC+/803mROchqM0xJ7VGzg4dzzDoI499+wiALkOzlE55rm/0nnF7R6eBA==@sourceware.org X-Gm-Message-State: AFq9FYJc0NSPThadSM/B9xYmr+U6i1OSNzQKsbYs4BRw6ii0lWwhGfEF gGOP7K8zkNcyBSbv5xKvWiV3QEKB5Tg3j+pGvZ3KX33fh1Wcvlghchy8Yr4dSc9BBTFcRingCbp yV6nNQ+IqFm4SAHFIpXPq2wSE4Zx56bbdnWSAP7FO7kkROeWmbyoy1YUf7igli10= X-Gm-Gg: AYBFou38B+juIWfaqSPOBepXZxU6MgTE+Mjbo/7yUedXYOGstTlAQwUlLQ3+l2lfXOG u3zWxmDdi3rsqAxYe750VQMivXkiqstQQB3tmR+IJWfM0Nd+tcSc3NVKnVS8r/jPsn14mSnNWuw ggqNGoC2U8mm4G7N0oCydRsuMW66c53C0m7JOy83f/karStIqJuHPED743Bl5u7qosSgidAF8L9 JImokETTu+DHe9wnDHckQTGB1AsdrffUWHc/fLh1rvf7ziJhMWmpbLuS2P5A+kvs6BycR6Oad1R MbSEcJE3BVMXo6t4uNhgcqqXASaz6/Sy2cJEcuVL7rAP2o19DUGtht/mzM6FTVAG3xps2XtfRkv T+g== X-Received: by 2002:a05:620a:d8d:b0:93e:e669:2a04 with SMTP id af79cd13be357-93ee6693346mr1462371285a.81.1791994569864; Wed, 14 Oct 2026 09:16:09 -0700 (PDT) X-Received: by 2002:a05:620a:d8d:b0:93e:e669:2a04 with SMTP id af79cd13be357-93ee6693346mr1462365885a.81.1791994569372; Wed, 14 Oct 2026 09:16:09 -0700 (PDT) Received: from [192.168.42.182] ([38.74.41.78]) by smtp.gmail.com with ESMTPSA id af79cd13be357-93ef5093213sm523069285a.41.2026.10.14.09.16.08 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 14 Oct 2026 09:16:08 -0700 (PDT) Message-ID: <2f250091-cc35-4c71-9389-51765e33f23e@redhat.com> Date: Wed, 14 Oct 2026 12:16:06 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 3/5] gdb: extend SECURITY.txt discussion of DWARF/BFD parser bugs To: Tom Tromey Cc: Andrew Burgess , gdb-patches@sourceware.org, Carlos O'Donell , adhemerval.zanella@linaro.org References: <9147299b6936533f5a056b9475f9b41b164bb1ff.1791812758.git.aburgess@redhat.com> <32c303aa-bd42-43b0-a141-9ee425859c38@redhat.com> <87fqy848pb.fsf@tromey.com> From: Siddhesh Poyarekar In-Reply-To: <87fqy848pb.fsf@tromey.com> X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: _nbKH7XMTVxfzhUl5HQp7zEhLfhjmovuj0ux8hFTdsw_1791994570 X-Mimecast-Originator: redhat.com Content-Language: en-US, en-CA, en-GB, en-IN Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces~public-inbox=simark.ca@sourceware.org n 10/14/26 11:12 AM, Tom Tromey wrote: >>>>>> Siddhesh Poyarekar writes: > >> On 10/12/26 9:49 AM, Andrew Burgess wrote: >>> 3. The real change: clearly state that bugs in the DWARF/BFD parser >>> can be security bugs, but they are unlikely to be considered high >>> priority, and users should instead use sandboxing to provide >>> protection. The text about bugs from well-formed programs is >>> retained. > >> I don't have a strong opinion on the meat of the change, but I want to >> point out that this is not sufficient deterrence for people flooding >> the project with such reports to get CVE creds in their name. What >> priority a CVE gets downstream is typically a result of perception and >> the relatively dumb CVSS scores. Unfortunately all major >> distributions are currently lost to that madness and "unlikely to be >> considered high priority" may not actually pan out that way in >> practice. > > I agree but we can only control gdb, not what other projects do. That > is, I think that CVEs are gamed dishonestly nowadays, but it's not clear > to me what other options we have for dealing with this. The glibc CNA plans to onboard the binutils project to the CNA program so that we can handle those and stem the CVE gaming for the project. We could extend that to gdb too if there's interest, but we will need volunteers from the gdb team on the security team because the gdb security policy is a bit more complex to interpret than the binutils one, which assumes that all input as trusted. Of course, we'd still need the policy to define what can be reasonably secured and exclude the rest from scope. Sid