From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id 6994I9Qz0mrnARsAWB0awg (envelope-from ) for ; Fri, 16 Oct 2026 10:25:24 -0400 Authentication-Results: simark.ca; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=U+/V9Tga; dkim-atps=neutral Received: by simark.ca (Postfix, from userid 112) id 793371E050; Fri, 16 Oct 2026 10:25:24 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-6.4 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham autolearn_force=no version=4.0.1 Received: from vm01.sourceware.org (vm01.sourceware.org [IPv6:2620:52:6:3111::32]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id 6E8EB1E04E for ; Fri, 16 Oct 2026 10:25:23 -0400 (EDT) Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 720AE4BA2E0B for ; Fri, 16 Oct 2026 14:25:22 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 720AE4BA2E0B Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=U+/V9Tga Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTP id DDA3A4BA2E06 for ; Fri, 16 Oct 2026 14:24:55 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org DDA3A4BA2E06 Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org DDA3A4BA2E06 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1792160696; cv=none; b=MB6bNbrFLPZ5H3xWmCuDy+AbrQS+286nRrSwxwOLhqK+IKTVuKDnJjvtb8hjV3yMiEsSWMEnts4Ef8wBW/KDlxg+Xnizgz+H9iPCgUGx+EMgae5Tyl5E+UEGHrUUyDx4JmlX66BJARq7FMX9Iy/sg80qzcdwPpmbDQSkOeZ8arA= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1792160696; c=relaxed/simple; bh=xtvj4xrMWqCNcFlTFFhGZ3lSFcYNZ8rlL2UONuV2CqI=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=lTVcoh/HWdUKsYABzz0F4Yp/VvoLRdgEMsDT6e512vaY7bMSfpUgbHLEgUi6ByEQtX/KKV8lWS8E3/afp2Q4n4HRfFyJbFyqC8xRntTTmEZAwlrTQ+g6ihe9s5v/v+LnkziYPXUBED4JeEjuRvb09KujyjKyjf7BNuAWYc3NcXk= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=U+/V9Tga DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org DDA3A4BA2E06 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792160695; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=as1miYLWzK4/5z623vzU9vae+OCbWk4iTxMHS3scdOA=; b=U+/V9Tgai9qYngxsVkeanXVwyFSI3CrHuUya4xA+4+lzqdubJvpsZ8uC3ZJjQG/TnicmUj mAxRjy4PykzrYMUl92Ifwaf5e8Bw+9bAEkTTysJl5Bxe+j6w58hylIEr57zdhFceca3I4y wc7ZEIHz+o7GLa8VXm6pMEAwC6ZRDh4= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-294-iLMR1w0HPZmzBh-NPFFTAA-1; Fri, 16 Oct 2026 14:24:53 +0000 X-MC-Unique: iLMR1w0HPZmzBh-NPFFTAA-1 X-Mimecast-MFC-AGG-ID: iLMR1w0HPZmzBh-NPFFTAA_1792160692 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-4a01ba12198so7675075e9.1 for ; Fri, 16 Oct 2026 07:24:53 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792160692; x=1792765492; h=content-type:mime-version:message-id:date:references:in-reply-to :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=as1miYLWzK4/5z623vzU9vae+OCbWk4iTxMHS3scdOA=; b=fKLOXuF6owyebwT3G4vMjUHb+MMkgtmTuxXpCOUmBLB0FEhAdL0PmBVW7vj1Y69fp0 rpdfurbpV3vZlTWHb9qTPlsCMMu0EznwagSE02Jv7bmrwFhsum2g2nNq+FVMTRuVjgc6 dG3hcyHFFPfRkFyweT6/T/j/o+7A5DkUJeVyI7p1fXKViajqz9f2PcYIPZWuYpqFD+im CunFO1UEBPMzKq68Bj1e9Q04YUQ5+prT22sLCIZY3lNbw32xMpdbGunhTY6B7HGCvCJo +8tUS9Axsdfg/gXTjlTj4RuasXhC6KNeNxTBp83TLAvBzYGjWlKQyCvNhwnO45PQcQaa kADg== X-Gm-Message-State: AFq9FYLVTUk/neCdKdJunIihCCOjmadVuWuNakVslSiCq9lOxgSbXjeQ C0kDAKdUeO3pjeG4aPOWacn0Uls82KJBCD84SbgbRYrqdRuIHCvQX8akYYHnXoIFwpe7J3LVSxj tUDUZSyO2Al4CgXPt8YENhb2nffZyVSvfBFZFAsno8GNeEtBuAV8Bn2mUQvMpblSo4NL+ZiA= X-Gm-Gg: AYBFou0eC/dKf6yoX5T2PrOMzgIcqPJwbAwTeFlW4iU+QbkI92SMVZwqiK6xHr8JBc6 CINVqxFgKsXVM5cu6JXqdj6CAeN0N5/dYVLF4BxReBw8mz3lTR47P2HgsNc0Fndx+4KfxUeTJTE Cb1ohawssGHXcgUGH5iifuOJOFU1wpN5RTrm/LC0WKQxIMT9ouD0+0OsO4uPeo49b5aFhkpYJBH nXaLQZ61P70ER1kBYVrAt3cMtUEBCT9y/7iC6eZfEnYbBK2AgH1GK47Uzne2d4iuEzUcPLPzPqC KxgaM1cNDPI8HyNwJSPl6CLVmgr7ysfectZq0BrwoTeKnuuo6OrUPmwiqHxZ5wGrD4RQSQ== X-Received: by 2002:a05:600c:3103:b0:4a1:88df:8a2a with SMTP id 5b1f17b1804b1-4a1c6681810mr74964815e9.13.1792160691912; Fri, 16 Oct 2026 07:24:51 -0700 (PDT) X-Received: by 2002:a05:600c:3103:b0:4a1:88df:8a2a with SMTP id 5b1f17b1804b1-4a1c6681810mr74964355e9.13.1792160691465; Fri, 16 Oct 2026 07:24:51 -0700 (PDT) Received: from localhost ([213.31.44.29]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1c9a6787bsm38168415e9.1.2026.10.16.07.24.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Oct 2026 07:24:49 -0700 (PDT) From: Andrew Burgess To: Siddhesh Poyarekar , Tom Tromey Cc: gdb-patches@sourceware.org Subject: Re: [PATCH 2/5] gdb: extend SECURITY.txt to highlight additional remote debugging risks In-Reply-To: References: <4a6d4fbc0037fcff1e4e5efc940aab03eb9e57f8.1791812758.git.aburgess@redhat.com> <87jynk48wz.fsf@tromey.com> Date: Fri, 16 Oct 2026 15:24:47 +0100 Message-ID: <87qzhp9100.fsf@redhat.com> MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: qdI1ZTJuNtAD-60hOF1eW1Yq98yerfsV4V_qcRAFG24_1792160692 X-Mimecast-Originator: redhat.com Content-Type: text/plain X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces~public-inbox=simark.ca@sourceware.org Siddhesh Poyarekar writes: > On 10/14/26 11:08 AM, Tom Tromey wrote: >>>> + Additionally, when GDB connects to a remote target, it will, by >>>> + default, automatically download the executable and shared libraries >>>> + from the remote system and parse them locally, without prompting the >>>> + user. This means that the risks described above relating to parsing >>>> + malformed executables also apply when performing remote debugging. >>>> + If the remote target is untrusted, or the connection to the remote >>>> + target is untrusted, malicious or malformed binaries could be served >> >>> This is a good guideline, but does not make clear if bugs in this >>> processing will be treated as security issues. This is true for the >>> line above as well, which this paragraph intends to augment - it warns >>> the user that such behaviour is not good, but does not make a >>> definitive statement whether bugs related to them will be treated as >>> security issues or not. >> >> I think it's relatively clear given these paragraphs: >> >> GDB is not meant to be offered as a service (that is, offered >> over an insecure connection to non-local users), and so denial of >> service attacks targeting GDB itself, or other bugs that target >> this use case, are not considered a security bug. >> ... >> Any issues that arise from running an untrusted program outside of a >> secure environment are not security bugs in GDB. Any issues that >> arise from running an untrusted program through GDB inside a secure >> environment are only security bugs if GDB is required in order to >> trigger the issue. > It's probably this clause that applies instead of the second one though, > since it's about loading an executable without running it: > > Any bug in GDB or gdbserver that can trigger arbitrary code > execution without the program being debugged having been executed by > a user command, is considered a security bug, e.g. if loading a > program into GDB could trigger arbitrary code execution, then this > is a security issue. > > except that the "if the remote target is untrusted" brings a new > variable into the picture. The policy assumes a trusted connection (the > first clause you quoted) but an untrusted target (the new clause), i.e. > an untrusted endpoint, which makes it moot. This inconsistency leaves a > gap in what's considered a security issue. Hi Siddhesh, Thanks for your feedback. I've added some additional text in this area to hopefully clarify the issues you have highlighted. The updated patch #2 is below. Thanks, Andrew --- commit 2879d94ad12bae33908f1fc967c79f59ee97919a Author: Andrew Burgess Date: Mon Oct 5 14:14:05 2026 +0100 gdb: extend SECURITY.txt to highlight additional remote debugging risks I had cause to re-read the SECURITY.txt document recently, and I felt that it wasn't really clear on one aspect of using GDB with gdbserver (or any remote target). I felt that the text wasn't explicit enough about how a remote target can download executables and libraries to GDB, and how GDB can then parse these files. When we consider the sort of bugs we see, especially in BFD and the DWARF parser, when it comes to badly formatted files, I thought it was worth calling this out. diff --git a/gdb/SECURITY.txt b/gdb/SECURITY.txt index f4ddebe3f03..64d68f88b84 100644 --- a/gdb/SECURITY.txt +++ b/gdb/SECURITY.txt @@ -210,6 +210,28 @@ Security Realities Of The GDB Project user to protect this connection, for example, by only starting gdbserver within a secure network. + Additionally, when GDB connects to a remote target, it will, by + default, automatically download the executable and shared libraries + from the remote system and parse them locally, without prompting the + user. This means that the risks described above relating to parsing + malformed executables also apply when performing remote debugging. + + If the remote target is untrusted, or the connection to the remote + target is untrusted, malicious or malformed binaries could be served + to GDB, resulting in any of the issues described above. Any bugs in + GDB triggered by such files are evaluated against the definitions in + this document independently of how the files were obtained. + + Any bug related to remote debugging, whether the remote connection + or target is trusted or not, is a security bug if the bug meets the + other definitions in this document. If an untrusted remote target, + or use of an untrusted connection makes use of a documented GDB + behaviour, then this is not a security bug in GDB. + + Users should apply the same precautions when performing remote + debugging as when analysing an untrusted binary locally, including + running GDB in a secure, sandboxed environment. + Reporting Non-Security Bugs ---------------------------