From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id 0X8NOfy7z2oqIAoAWB0awg (envelope-from ) for ; Wed, 14 Oct 2026 13:29:32 -0400 Authentication-Results: simark.ca; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=gSIIPFlD; dkim-atps=neutral Received: by simark.ca (Postfix, from userid 112) id DAB971E050; Wed, 14 Oct 2026 13:29:32 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-6.4 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham autolearn_force=no version=4.0.1 Received: from vm01.sourceware.org (vm01.sourceware.org [IPv6:2620:52:6:3111::32]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id 2C0F71E04E for ; Wed, 14 Oct 2026 13:29:32 -0400 (EDT) Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id E513D4BA23E1 for ; Wed, 14 Oct 2026 17:29:29 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E513D4BA23E1 Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=gSIIPFlD Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTP id A2E184BA5434 for ; Wed, 14 Oct 2026 17:29:05 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org A2E184BA5434 Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org A2E184BA5434 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1791998945; cv=none; b=mQPwKfpQEd0HvLcEFiUQVBCTwcrPWFhmoM27z50OIxlr+tqcyxZ1dSzZhyCZ47G6xdpZA7QCVu+VuzC/6p9OMzIJ924NQPeX8IsDP2nEUnCggVlJi9VOYilT66Vfoz9JgnbO43sfX2/vmfBGhUX1Dw1MtD+M9AlVDvMeIA1YnoY= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1791998945; c=relaxed/simple; bh=JSnyLmF4vHehOk+8IlScyAvQa+gtTqSf9KtW5NZHhtw=; h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From; b=pInHL/Nz3WOHUCrf0tqgQm2uywiH09JtDVmWvs1XHYsXaWbNh8n46Lvg3xDLpjGRwZjhvhnnSYK35mIjimsM4/50vYuDXhu5BV+KShGBDGJDo6omJgWKaYWEUQxT+2QRY5tGJ9jqB5ZQfR+f9NMufswp3zLTdUIoto73wRgpPok= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=gSIIPFlD DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org A2E184BA5434 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1791998945; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=IIgf6eQ154zfjUT61O3w9nezj/lK4IxqHdfw2g0vFpE=; b=gSIIPFlD0YviNqKtLr5jBYLy8KIUX7k04ZlGU7I9YZmlPE4zKKhIO6WV3ATf4FgIF/1c0Q 0bUcfj4ZHhAgo6n5sgOeedew7/CBT2sk1yQlZWsg6CqdXTOCRYoKU8slU/ODotSbNTqMu7 y9lrRAs3ROk2dOUtPE5FzOWZO3r2PjM= Received: from mail-qk1-f197.google.com (mail-qk1-f197.google.com [209.85.222.197]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-321-5TaE6S6PPtOt_j9YCHm9BQ-1; Wed, 14 Oct 2026 17:29:02 +0000 X-MC-Unique: 5TaE6S6PPtOt_j9YCHm9BQ-1 X-Mimecast-MFC-AGG-ID: 5TaE6S6PPtOt_j9YCHm9BQ_1791998942 Received: by mail-qk1-f197.google.com with SMTP id af79cd13be357-93cc7a6e4e1so1339331185a.1 for ; Wed, 14 Oct 2026 10:29:02 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791998942; x=1792603742; h=content-transfer-encoding:content-type:in-reply-to:organization :autocrypt:from:content-language:references:cc:to:subject:user-agent :mime-version:date:message-id:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=IIgf6eQ154zfjUT61O3w9nezj/lK4IxqHdfw2g0vFpE=; b=rJ/A9x421K7gRrqEZZDLTrqn+6/UF8bLLFFtZZHFJKPjXXpnU4mqLnsjN0BAXYzC/C GyOjhu9y8dXF68mdiWa9+zbY7FxD1kDmH/xcvnBKgEkN10eR6kb3Na5lUbev0qncziqr DwWDw+0HBIg2tyfFaEXKvLaGcQzFnU09azASKIlkVm862X/p19p9C6YkbVSOKJwwQhyl o36Acsbd1lMELq651920xSAGbc4yKn7vE+C01RPYRcjWkFhBX7HDNcgVaHt3ftidLNv/ 0PCJ0CWRAOvBwp/0z8hXjyKZaazpFX2rzIYlJTJGxEFR3CBcy8bpn1kvnXam5vydODMO bkCA== X-Forwarded-Encrypted: i=1; AKwUvByCGeHq27dbjgBhzTNSR2PYt/pS9v8Ups5JM1zrYb7Ka1X5clnvwc1k2AbkkMtq9fxVIqmM9adSwcIGMg==@sourceware.org X-Gm-Message-State: AFq9FYIK7dKKFJn6hSm+salNLDXulYaH3YWw4yW1jDXI/ItoMhzg0qYq LOGR+xBDgfSsUr+Y8UfXkcD/ZMNiYiSr7CL6bE+krsqbwrbE2sJvb81hfC+Rxwvp/2z6xrkI1/3 XlJF8oIZrSAG+A0vuJvuD5LeG4Z1JKANVxnW7dZ+KGfhBf/kOWZpxAyhk4mkrqB2mzRNys/4= X-Gm-Gg: AYBFou0LKlP5pwsD0nelx1J/nfMuUaUmyIxUqVGqhc/K4y5qWRt+3bs5yWggTOEybsA 6prvQGHhuOD98biUUCwbNR5wOfKP9n3IWCxc6WAjxtmsvusgB6c7oB6AqM/aimY4rR4V3d4hA61 uZIm3ryBVdzMpydlAMlV+61jGK6UgmZsTwl8lTgkcY0de5ZV7QFqp3EdqABWYrmTaDFo4mFGFSj qNaCSkB1i+9qQoWxBQigk5Z4WKokGwLXt4bGRha3UNde2Mb8mhLVfsnoGaGMejEvNtvRfbSXuVX +ASYNY5Aw8uvfElCI7STprXFVTnZPqU74XXivZqrauk27ou30DLYXO91AtkA34Ke9gDJA9wv5Ki RihY0KWnHFe4hWbiLnAClcjVY22Nv3K2+U42CJqzXyJoeTy5GHuYb+5KE9GN44XG9eAui1MAi52 I= X-Received: by 2002:a05:620a:370d:b0:93f:baf:279e with SMTP id af79cd13be357-93f0baf2b5dmr165861485a.8.1791998942261; Wed, 14 Oct 2026 10:29:02 -0700 (PDT) X-Received: by 2002:a05:620a:370d:b0:93f:baf:279e with SMTP id af79cd13be357-93f0baf2b5dmr165858085a.8.1791998941739; Wed, 14 Oct 2026 10:29:01 -0700 (PDT) Received: from [192.168.0.116] ([198.48.244.52]) by smtp.gmail.com with ESMTPSA id af79cd13be357-93ef505463esm539046285a.32.2026.10.14.10.28.59 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 14 Oct 2026 10:29:00 -0700 (PDT) Message-ID: <795043f3-6f1a-4903-a6c0-ef04ce14e074@redhat.com> Date: Wed, 14 Oct 2026 13:28:58 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 3/5] gdb: extend SECURITY.txt discussion of DWARF/BFD parser bugs To: Siddhesh Poyarekar , Tom Tromey Cc: Andrew Burgess , gdb-patches@sourceware.org, adhemerval.zanella@linaro.org References: <9147299b6936533f5a056b9475f9b41b164bb1ff.1791812758.git.aburgess@redhat.com> <32c303aa-bd42-43b0-a141-9ee425859c38@redhat.com> <87fqy848pb.fsf@tromey.com> <2f250091-cc35-4c71-9389-51765e33f23e@redhat.com> From: Carlos O'Donell Autocrypt: addr=carlos@redhat.com; keydata= xsFNBFef5BoBEACvJ15QMMZh4stKHbz0rs78XsOdxuug37dumTx6ngrDCwZ61k7nHQ+uxLuo QvLSc6YJGBEfiNFbs1hvhRFNR7xJbzRYmin7kJZZ/06fH2cgTkQhN0mRBP8KsKKT+7SvvBL7 85ZfAhArWf5m5Tl0CktZ8yoG8g9dM4SgdvdSdzZUaWBVHc6TjdAb9YEQ1/jpyfHsQp+PWLuQ ZI8nZUm+I3IBDLkbbuJVQklKzpT1b8yxVSsHCyIPFRqDDUjPL5G4WnUVy529OzfrciBvHdxG sYYDV8FX7fv6V/S3eL6qmZbObivIbLD2NbeDqw6vNpr+aehEwgwNbMVuVfH1PVHJV8Qkgxg4 PqPgQC7GbIhxxYroGbLJCQ41j25M+oqCO/XW/FUu/9x0vY5w0RsZFhlmSP5lBDcaiy3SUgp3 MSTePGuxpPlLVMePxKvabSS7EErLKlrAEmDgnUYYdPqGCefA+5N9Rn2JPfP7SoQEp2pHhEyM 6Xg9x7TJ+JNuDowQCgwussmeDt2ZUeMl3s1f6/XePfTd3l8c8Yn5Fc8reRa28dFANU6oXiZf 7/h3iQXPg81BsLMJK3aA/nyajRrNxL8dHIx7BjKX0/gxpOozlUHZHl73KhAvrBRaqLrr2tIP LkKrf3d7wdz4llg4NAGIU4ERdTTne1QAwS6x2tNa9GO9tXGPawARAQABzSpDYXJsb3MgTydE b25lbGwgKFdvcmspIDxjYXJsb3NAcmVkaGF0LmNvbT7CwZUEEwEIAD8CGwMGCwkIBwMCBhUI AgkKCwQWAgMBAh4BAheAFiEEcnNUKzmWLfeymZMUFnkrTqJTQPgFAmod99EFCRRfRy8ACgkQ FnkrTqJTQPiF+hAAhstxT3ao2pBuNQNh7/yieJxsQ0YrI0vZeIMM/P5kxzr0X/+CNCFx/bbk ogjOVgVMUD1WzqW6zY8lsj3/RPiBsowZBJYXIsWfdvYq33WwgtiXA/1AUZ60/lfWIQdPQJDL 8/FXzRy8P4B/DoSpMOU11S5Kk8j5R9mBk/NSrNreO/nB1e4qNFF5GluBUsxMjKrGkkOxUZPQ uGNjcgdxRibNVD8n+lp9UU9+rsFKNOK7F0l9/ltR6j8kVagMKikXsaoUFU6WUbGHQ+ZBPdY8 o8izXbQLoW/kD1qxbMsviBPaszaRZTyKd4ZEz54dx4up3vLorBoLI6YcG2oTqIdx8YZSXdfK WVPhQsJKG/QgiPztGYzT93KvhHlQ3+D9GZBU0ovAWc4YkBjxLPsw4DLhgFGLgIGhFHuMY3jy qlzez8KpoehH7mEgc5yGBtbnejnhuo7N6q6SUEGcSWlyLsdHMPZOg2UhpJ4pS9u7vG9Cz7+b yxItTMJ0XhRjQIkdm+38lH1yaOqVU9jvTgpPf3P9vT3Xo5vCa8PM5U7oL/Be2O6JH4hj9835 h0AJfKsDJD50OgS9zI8e51X+vSTir1Kk+tMJJgZLYqYsSKOwUm+vVLby1pK171lIuu1qjx6I Rqz9CxmD5iRWIeIaOGGI+gce4eeMBH1IbFS6EjHT2hu+AfoURjjOwU0EV5/kGgEQAKvTJke+ QSjATmz11ALKle/SSEpUwL5QOpt3xomEATcYAamww0HADfGTKdUR+aWgOK3vqu6Sicr1zbuZ jHCs2GaIgRoqh1HKVgCmaJYjizvidHluqrox6qqc9PG0bWb0f5xGQw+X2z+bEinzv4qaep1G 1OuYgvG49OpHTgZMiJq9ncHCxkD2VEJKgMywGJ4Agdl+NWVn0T7w6J+/5QmBIE8hh4NzpYfr xzWCJ9iZ3skG4zBGB4YEacc3+oeEoybc10h6tqhQNrtIiSRJH+SUJvOiNH8oMXPLAjfFVy3d 4BOgyxJhE0UhmQIQHMJxCBw81fQD10d0dcru0rAIEldEpt2UXqOr0rOALDievMF/2BKQiOA7 PbMC3/dwuNHDlClQzdjil8O7UsIgf3IMFaIbQoUEvjlgf5cm9a94gWABcfI1xadAq9vcIB5v +9fM71xDgdELnZThTd8LByrG99ExVMcG2PZYXJllVDQDZqYA1PjD9e0yHq5whJi3BrZgwDaL 5vYZEb1EMyH+BQLO3Zw/Caj8W6mooGHgNveRQ1g9FYn3NUp7UvS22Zt/KW4pCpbgkQZefxup KO6QVNwwggV44cTQ37z5onGbNPD8+2k2mmC0OEtGBkj+VH39tRk+uLOcuXlGNSVk3xOyxni0 Nk9M0GvTvPKoah9gkvL/+AofN/31ABEBAAHCwXwEGAEIACYCGwwWIQRyc1QrOZYt97KZkxQW eStOolNA+AUCah337wUJFF9HVQAKCRAWeStOolNA+FSnD/sHeLb9vaXHABC/1eyrScwSDfZs MFsdjzZZqGbnbdj4uP4oyt3uztsxJASgHRQ/DhaPsms3Ai+kWhf5EHOBC9cPSn0aHZL52nT+ MdbTu2VvvVRfECSm+lo/NkTGoXkF+n6TFd7tQGmSjdudvUhiKfSzep3GYseknmb9+7/DGluv QjuDb8quUVglMifp3qRUH4yPo7BS8ak59t4FUc8m2ggglgcvzKCRgqgEtrP2vM6EFzUiRJ1Y 0et5kedtiAI1e9ehVeyytFELputja7EzAxWv+pQ2m/jhfoAHx/FTqw4PdrtH2zY9SmCheWDE wIgA+eyAHTG/X5DFq2P45agY6K+cvlDvr6V2NDsoOYI91A0VKahKkNIDAsMJ7sqMys/qw9kp dJVZaDqoNdY9NtDayLWXPXyJZEAy0Xsvw0vdoswthtjQmeZWhx2fMSCwG8mQlAya+nnfalPi iuPL6BUkk7naKk9wHpEZDMlyp6CLefLe1ioVFhnN2nL5SseY9nnmDo05lidf11U4VVWsVHJ+ ViM9CQLD+NCazBNavYUPBEpFuT7HX4zWfpTNU9GXbEYcvrUb6Oo59/9ns7e9stTuskyxxxyY ryfF9FLmLQkM9soiwxGIt6k7ObkNsBRYzuM5q1lmDV6MA1llxUPmf9e5b3OFJ7gqXeRZ5niK hsfHTTi7JQ== Organization: Red Hat, LLC. In-Reply-To: <2f250091-cc35-4c71-9389-51765e33f23e@redhat.com> X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: fDaq6iZkorDQTXkyu5eQ8fJm77dPC8r_pZIIjgqhomQ_1791998942 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces~public-inbox=simark.ca@sourceware.org On 10/14/26 12:16 PM, Siddhesh Poyarekar wrote: > n 10/14/26 11:12 AM, Tom Tromey wrote: >>>>>>> Siddhesh Poyarekar writes: >>> On 10/12/26 9:49 AM, Andrew Burgess wrote: >>>> 3. The real change: clearly state that bugs in the DWARF/BFD parser >>>> can be security bugs, but they are unlikely to be considered high >>>> priority, and users should instead use sandboxing to provide >>>> protection. The text about bugs from well-formed programs is retained. >> >>> I don't have a strong opinion on the meat of the change, but I want >>> to point out that this is not sufficient deterrence for people >>> flooding the project with such reports to get CVE creds in their >>> name. What priority a CVE gets downstream is typically a result of >>> perception and the relatively dumb CVSS scores. Unfortunately all >>> major distributions are currently lost to that madness and >>> "unlikely to be considered high priority" may not actually pan out >>> that way in practice. >> >> I agree but we can only control gdb, not what other projects do. >> That is, I think that CVEs are gamed dishonestly nowadays, but it's >> not clear to me what other options we have for dealing with this. > The glibc CNA plans to onboard the binutils project to the CNA > program so that we can handle those and stem the CVE gaming for the > project. We could extend that to gdb too if there's interest, but we > will need volunteers from the gdb team on the security team because > the gdb security policy is a bit more complex to interpret than the > binutils one, which assumes that all input as trusted. I'm happy to offer mentorship and training for anyone from the gdb community that wants to join the security team. It would help us better document onboarding and review policies :-) > Of course, we'd still need the policy to define what can be > reasonably secured and exclude the rest from scope. Agreed. -- Cheers, Carlos.