From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id aaizCbTlzGpyzToAWB0awg (envelope-from ) for ; Mon, 12 Oct 2026 09:50:44 -0400 Authentication-Results: simark.ca; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=fTNveZLu; dkim-atps=neutral Received: by simark.ca (Postfix, from userid 112) id 220D11E04E; Mon, 12 Oct 2026 09:50:44 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-6.4 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham autolearn_force=no version=4.0.1 Received: from vm01.sourceware.org (vm01.sourceware.org [IPv6:2620:52:6:3111::32]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id BA27A1E04E for ; Mon, 12 Oct 2026 09:50:42 -0400 (EDT) Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id B4C844BA23D8 for ; Mon, 12 Oct 2026 13:50:41 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B4C844BA23D8 Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=fTNveZLu Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTP id 593DA4BA23EF for ; Mon, 12 Oct 2026 13:49:33 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 593DA4BA23EF Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 593DA4BA23EF Authentication-Results: sourceware.org; arc=none smtp.remote-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1791812973; cv=none; b=fVPnIcfzAb586XzZz3d5Adn79YFu8X9F27L7RxCzc8zkxgTdcXwZN6XfOLpG3VmbSUNzqnUPon414NrqGvyhYpECCu0nIDwDEcCva1Q1Qws0gTlPG3TnUUk6FO+yksqy5U6c7YHgCaN+iJp6PIPvVAmNA0DOwq2YDv49dDfC4C0= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1791812973; c=relaxed/simple; bh=AlaCBsFXjCDowhaDELoxxSdqmE3eMwVtvH18O1I2+sU=; h=DKIM-Signature:From:To:Subject:Date:Message-Id:MIME-Version; b=qUuqeJAf93brdA1snRZusHanao0Md1AkR7sBXd4sWlFEZVzRVkdlsm1/W86a2EhWnrlr0sVct8Ag3cbtPpqLc01CJmQNWVVcofcVXP349GYSdac98MRrLU7A3qlTH5Y5x7SDjFngCN+61jcfutQx33A2/btCsmNo9sTYFTtFeAw= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=fTNveZLu DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 593DA4BA23EF DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1791812973; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=l/feHeN2CMCqqli5LaGGbCYWBtyrk30NlM42JfSUUzE=; b=fTNveZLuV9pjZAp6TVJ19mbZYOgLzdgs7a3reX5IaALl9IB9rXEH2tccHp7lTmCzr3WwQc yXLT0zfNaygCNDV/RRCV1bpF2Dj+5hxLwBOsnUSQ0SjH4ISbz1hiL6qWFlWFLrOzx0Q2gT 1tV9IaTf3VZhI5SAfB7GtAB3Zt6fZWg= Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-623-q_9Xy-cpNIurKZ8aLIN1ag-1; Mon, 12 Oct 2026 13:49:29 +0000 X-MC-Unique: q_9Xy-cpNIurKZ8aLIN1ag-1 X-Mimecast-MFC-AGG-ID: q_9Xy-cpNIurKZ8aLIN1ag_1791812968 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-4a17741243eso11514865e9.0 for ; Mon, 12 Oct 2026 06:49:29 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791812968; x=1792417768; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=l/feHeN2CMCqqli5LaGGbCYWBtyrk30NlM42JfSUUzE=; b=hKn8mwcgYoyxZxNHx8PxLoKkbPKo+9ESRFR9UpI2pd57PvWdW9+vxj1auO3V/dXK/g kPjEv4jZEu6SsIqloUAkcAETft01KYOUVZY4FP6r1GzgLTW68nRp1jr4vCo3eIj1Vvi/ vZXZmxApQ2KgltL+Pba69RkcJiBuGq1gP01xfQEXESSxqjiDrPWvVRuZ92ifCdIsvU8I QEoaYJB+KZe2HUA6GjvjpdqrSkMnHXksMqnbf/B5+3LB2Mpm79MliYw/FxHIn4hHG34d atECpDyBR1yCw8/pZnytIDZdt7aJCKEZWCa8FOnZELxm2rvD6ofxbHTcMhIjPkuD5xt4 WwPw== X-Gm-Message-State: AFq9FYIj1CAen/BXhUkyMC7HfXXdxwfX9kaRkKr+RAwu6QieFpDd8lX5 v/I6R8DfgzeLniSxdGifPs8d3je+3BmDrbHHbW+hT5r9TXXyqeh0NeBuG9pzBeQ/YW+eFoGxJXP +msJ5yv/D6SDY+CFDDBAoI4oH0cmXWSzFHhqKFTwlNSQbisVfkB4TrOVhZRWDIXU0p/X8cEzKb/ R/tsAxfaX+ak1YZ8htHMAb+LCDlGr7sBl1WndqtpGv9/VWsHs= X-Gm-Gg: AYBFou0zmB7CYMnJ6lAqHWQumXE6FomoorZeqn+YKQJvr3KI4yLUIIk9PhtkTluvh2x 9e1p0AUDuaGm8vPkDfMhnu0cgDIIUGGTpxwxwUVG2DPPvLoEgyo75EdyvBY1DHrcbvTm8AyHi0n d5jETlm7AwXt/ZKT+lwO6hoso7lLNXrBL7x+JOJi80bzcJzbN5lLWne07e+AcbZGMNpeP1ssr+j P9BRes+wf4IZeKI0QR0r/Wpl/7j9wgPxS7sXcG6J+/R1EJqFM1Lv2Q+uZ4qOClr5GQEshwWLj76 k57zyxionmZIGlS++K8T4PrTDQThSBulmD5UgOE8ktqdKpjZaw0PFkSU0AiqbtsmqPYr X-Received: by 2002:a05:600c:699b:b0:4a0:4a8:d444 with SMTP id 5b1f17b1804b1-4a18e4af334mr187456545e9.33.1791812968248; Mon, 12 Oct 2026 06:49:28 -0700 (PDT) X-Received: by 2002:a05:600c:699b:b0:4a0:4a8:d444 with SMTP id 5b1f17b1804b1-4a18e4af334mr187455925e9.33.1791812967573; Mon, 12 Oct 2026 06:49:27 -0700 (PDT) Received: from localhost ([213.31.44.29]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a18dcd7dd3sm185253745e9.2.2026.10.12.06.49.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 06:49:27 -0700 (PDT) From: Andrew Burgess To: gdb-patches@sourceware.org Cc: Siddhesh Poyarekar , Andrew Burgess Subject: [PATCH 4/5] gdb: in SECURITY.txt, add notes on reporting exec and debug bugs Date: Mon, 12 Oct 2026 14:49:13 +0100 Message-Id: <8152e3e493133b41bcf71f4af9309bff3322f10b.1791812758.git.aburgess@redhat.com> X-Mailer: git-send-email 2.25.4 In-Reply-To: References: MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: 89Fdt4I1rwDSddsv7xvakklp2SrHzSgWNjSFr2SGyr0_1791812968 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: 8bit content-type: text/plain; charset="US-ASCII"; x-default=true X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces~public-inbox=simark.ca@sourceware.org The previous commit clarified the wording about bugs related to parsing malformed executables and debug information. Bugs in this area can be security bugs, but will not be treated with high priority by the GDB project. Given this, it does not seem sensible to me that these bugs should be reported via the more secret bug reporting path. At the end of the day fixing these bugs is unlikely to be a priority, so the bugs will likely end up in the public bugzilla anyway. I propose that we advise that these bugs just be added to the public bugzilla from the start. I'm aware that this advice might be a little contentious, and that is why I've carved this change out from the previous one. This makes it easier for people to agree with the previous commit, but disagree with this one. --- gdb/SECURITY.txt | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/gdb/SECURITY.txt b/gdb/SECURITY.txt index 533b70b5875..b484a1f65a1 100644 --- a/gdb/SECURITY.txt +++ b/gdb/SECURITY.txt @@ -238,6 +238,13 @@ Reporting Non-Security Bugs https://sourceware.org/bugzilla/ + Bugs related to parsing malformed executables and debug information + should be reported through the public bugzilla. This is an area of + GDB containing known bugs, and as discussed above, it is advised + that users mitigate these bugs by running within a sandboxed + environment. As such, these bugs are considered to pose limited + risk to users. + Reporting Security Bugs ----------------------- -- 2.25.4