From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id wS5dGKHlzGomzDoAWB0awg (envelope-from ) for ; Mon, 12 Oct 2026 09:50:25 -0400 Authentication-Results: simark.ca; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=EGBWZguE; dkim-atps=neutral Received: by simark.ca (Postfix, from userid 112) id 5D7591E051; Mon, 12 Oct 2026 09:50:25 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-6.4 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham autolearn_force=no version=4.0.1 Received: from vm01.sourceware.org (vm01.sourceware.org [IPv6:2620:52:6:3111::32]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id 8CD461E04E for ; Mon, 12 Oct 2026 09:50:24 -0400 (EDT) Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id AC7954BA23F3 for ; Mon, 12 Oct 2026 13:50:23 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org AC7954BA23F3 Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=EGBWZguE Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTP id 48A5C4BA23D3 for ; Mon, 12 Oct 2026 13:49:31 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 48A5C4BA23D3 Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 48A5C4BA23D3 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1791812971; cv=none; b=ZmfV/vCtvTVP27RnTL6MFbP8NvYZCNbZ9M8PqTIe6kiPq43o5lGiHCdmsqv8HYP6mc6/e1ilcaRGrtyAemVjc8RgrLzXnAd3hRs5P95OQMWpnYsPtN3w1BGJ+pucwcGwC+UdT/JcUKewYLw50MvafYNCn6/OOYgn0C0UYdSLZKs= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1791812971; c=relaxed/simple; bh=/uaPFwyeTkbR6rUIGsAEvpvl7mSVdaHoFkuGsOuRr60=; h=DKIM-Signature:From:To:Subject:Date:Message-Id:MIME-Version; b=T+G1wXxr2rtIiV7sMIA7CTEieFGArUSjxi/PRTiwt9IjBb01p4VGirV37Up+QFSVSjdffnhlawR4im3ZjU7yFGK26poe/MPxgYHB87JHdsHPya1d1uEV9tQuSDiJNlFWW4eOtsgjVhjqzoGn8rYbNy0ZUipB2R74kbyv1evesfw= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=EGBWZguE DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 48A5C4BA23D3 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1791812971; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5tCkt9FC8rG3n3o46ZDsmOD24Zhqh5rpQZpaHOPd6RE=; b=EGBWZguEMq0vVp7wt17DWbjRQ06rqoeDpbFhBwQ99xps3XJGAZUQ4PuYQBbjI6Qo1BFp7q AmqiX6knyrdRYO96yFfDEOTSn4VPEo+MwnRqz/1rstO2etP8q6VPgD1jpvmpXQrwA7vezp BG7H0piwfIL62Rr6/GwRCn099SMrT08= Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-381-sLl8CXXyMqav2JwCXshisA-1; Mon, 12 Oct 2026 13:49:29 +0000 X-MC-Unique: sLl8CXXyMqav2JwCXshisA-1 X-Mimecast-MFC-AGG-ID: sLl8CXXyMqav2JwCXshisA_1791812968 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-4a165fb7beeso18123455e9.0 for ; Mon, 12 Oct 2026 06:49:28 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791812968; x=1792417768; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=5tCkt9FC8rG3n3o46ZDsmOD24Zhqh5rpQZpaHOPd6RE=; b=YWHTzTfRQdriQRkqgNKqLuerYhVHe42fEIXIMT21OyO1cUbpPNWcVu1WOTJ4x8Ecyy RKWxJ712hO2kHXm5SzahDyFHkHAvG9lXMluLUCbomSI3fiXSKygHLTcygiKZrr6Al2/x YRXPYO21h7G5J2kqYbpsKnZG3z0nG1HXoMKsVMSgrgv+GxYXy2q30zw0L54LMnvmIfr4 6Ei1UBZnumzZzSf5bgMUp04pkenr4GFQL7jXifChOfD4gtfrc/yE161j+mojDFB8f/LX b0LTa/Lo2tm4WH1uqYbQDvPTaKSDl9DJFyYcQQKmYW/DPN3GK1tgMu9BAPUGC3k5yReN OPxA== X-Gm-Message-State: AFq9FYK6ckpIoq880rJQ88J4G6D6YTTSmWxgs9q1s+wMy6mHMP4uQ96o xSlGS8zGkgA6sa5mD2ye4EBzFNioq3pdHNIfN/Ci+OjmZng+9feelrtl5ZbaLLKAO/H/BcmYaS/ +1gOdm6V9xwS7oIE5aqeINVTDmh8Yz0K0tN6krMdOvn84KZb1aKQnLZIij/3SGL0atkW71SLFRv +Fxu5c9PdbZmfNnxfgftjlcszqWkhBrI2Y4zhvG4lnHcoVVzg= X-Gm-Gg: AYBFou1ycq2/6H/5MYWWleZ4DzmBlrWUNNL4pvSxmzXlnrIHGgklbQH1tySgHwkq6Cl GN0yD3rp0h64VLEElmK2anZm5Xh/UOC33n/mfbstoPTumD4uhYd0gzmHgDKzEtPFf0+SKm7x7gM IIOgg6w9PU3OHVM4KDiO8TckAU/YuzfFi2+cXFzkB0OnXqlr8Qj61VyvL45l2JU9XDGlyFtb0ev x/Gryt/r2JJKtrYayZXdcNLoKNBCrQcmAwOEdsb3nUe1spUP6QRY6bFYipJ16O+mvQZtQ8l3brd 40dp3v3O5rh+uUArXMjSu3No0IXdkl5rnqVW0yq7H3VR3fzUFAFE8l3CAcjzFlFjHHRg X-Received: by 2002:a05:600c:4685:b0:4a0:27eb:49b with SMTP id 5b1f17b1804b1-4a18e4ae6fcmr197583995e9.30.1791812966194; Mon, 12 Oct 2026 06:49:26 -0700 (PDT) X-Received: by 2002:a05:600c:4685:b0:4a0:27eb:49b with SMTP id 5b1f17b1804b1-4a18e4ae6fcmr197583465e9.30.1791812965608; Mon, 12 Oct 2026 06:49:25 -0700 (PDT) Received: from localhost ([213.31.44.29]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48ddaefa06esm3164933f8f.20.2026.10.12.06.49.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 06:49:24 -0700 (PDT) From: Andrew Burgess To: gdb-patches@sourceware.org Cc: Siddhesh Poyarekar , Andrew Burgess Subject: [PATCH 3/5] gdb: extend SECURITY.txt discussion of DWARF/BFD parser bugs Date: Mon, 12 Oct 2026 14:49:12 +0100 Message-Id: <9147299b6936533f5a056b9475f9b41b164bb1ff.1791812758.git.aburgess@redhat.com> X-Mailer: git-send-email 2.25.4 In-Reply-To: References: MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: 7Y-njj6xC9On32otIQEoZ9nxKsA12J456nPv70vsnQ8_1791812968 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: 8bit content-type: text/plain; charset="US-ASCII"; x-default=true X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces~public-inbox=simark.ca@sourceware.org I believe there is some ambiguity in the SECURITY.txt file when it comes to bugs within the DWARF and BFD parsing code. Here are the relevant passages: Any bugs in GDB or gdbserver that result in an unexpected crossing of a privilege boundary are considered security bugs. Some examples of crossing a privilege boundary include: being able to execute code as an arbitrarily different user, or accessing resources (e.g. files, sockets, etc) for which the original user would not normally have access. And: Any bug in GDB or gdbserver that can trigger arbitrary code execution without the program being debugged having been executed by a user command, is considered a security bug, e.g. if loading a program into GDB could trigger arbitrary code execution, then this is a security issue. And later on: There are known bugs in GDB related to loading malformed executables and parsing the debug information, a consequence of these bugs is that a malicious program could trigger undefined behavior in GDB, which could be used to trigger arbitrary code execution. ... As there are already known bugs in GDB relating to undefined behavior triggered from malformed programs, further bugs in this area should still be reported, but are unlikely to be given high priority. Bugs in GDB that are triggered by well-formed programs should also be reported, and are likely to be treated as higher priority as these are more likely to impact normal use of GDB. I think this final paragraph is confusing. Is a bug in the DWARF/BFD parser a security issue or not? I certainly have no desire to invite a deluge of security bugs relating the DWARF/BFD parsing, nor am I volunteering to spend all my time fixing these bugs. But, given our definition of a security bug, I think we need to acknowledge that DWARF/BFD parser bugs are security issues (if they meet the earlier definition). However, I do think we should be honest about how likely these issues are to be fixed, i.e. not necessarily as a high priority. The changes I propose here then clarify this area: 1. Clarify that the ideal is we'd like GDB to be bug free, but be firmer in saying that we believe there are bugs, and that these bugs could be security issues. 2. Rewording, replace 'when using GDB with an untrusted binary' with 'when examining or debugging an untrusted binary'. This avoids repeating GDB and places the focus on the actions being performed. 3. The real change: clearly state that bugs in the DWARF/BFD parser can be security bugs, but they are unlikely to be considered high priority, and users should instead use sandboxing to provide protection. The text about bugs from well-formed programs is retained. --- gdb/SECURITY.txt | 40 ++++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 18 deletions(-) diff --git a/gdb/SECURITY.txt b/gdb/SECURITY.txt index 63e110055db..533b70b5875 100644 --- a/gdb/SECURITY.txt +++ b/gdb/SECURITY.txt @@ -184,26 +184,30 @@ Security Realities Of The GDB Project When using GDB to examine, but not execute, an untrusted program (with gdbserver, the program will be started, but paused at the - first instruction and not run further), there should be no security - risks, however the GDB maintainers don't currently believe that GDB - or gdbserver is reliable enough to ensure that there are no security - risks. + first instruction and not run further), ideally there should be no + security risks. However, there are known bugs in GDB related to + loading malformed executables and parsing the debug information, a + consequence of these bugs is that a malicious program could trigger + undefined behavior in GDB, which could be used to trigger arbitrary + code execution. This means that even just loading an untrusted + executable into GDB, without executing the program, can pose a + security risk. - There are known bugs in GDB related to loading malformed executables - and parsing the debug information, a consequence of these bugs is - that a malicious program could trigger undefined behavior in GDB, - which could be used to trigger arbitrary code execution. + Given these risks, the advice of the GDB project is that, when + examining or debugging an untrusted binary, always do so in a + secure, sandboxed environment. - Given these risks, the advice of the GDB project is that, when using - GDB with an untrusted binary, always do so in a secure, sandboxed - environment. - - As there are already known bugs in GDB relating to undefined - behavior triggered from malformed programs, further bugs in this - area should still be reported, but are unlikely to be given high - priority. Bugs in GDB that are triggered by well-formed programs - should also be reported, and are likely to be treated as higher - priority as these are more likely to impact normal use of GDB. + Bugs related to parsing malformed executables and debug information + can meet the definition of a security bug as described in this + document. However, the GDB project believes there are likely to be + many such bugs, and addressing all of them as high priority security + issues is not feasible given current project resources. Users + should instead rely on sandboxing as the primary mitigation. Bugs + in this area should still be reported through the normal bug + reporting process and will be addressed when possible. Bugs in GDB + that are triggered by well-formed programs should also be reported, + and are likely to be treated as higher priority as these are more + likely to impact normal use of GDB. When using GDB and gdbserver to perform remote debug, the connection between the two components is by design insecure. It is up to the -- 2.25.4