Re: [PATCH 2/5] gdb: extend SECURITY.txt to highlight additional remote debugging risks

[Siddhesh Poyarekar <sipoyare@redhat.com>]

On 10/12/26 9:49 AM, Andrew Burgess wrote:
> I had cause to re-read the SECURITY.txt document recently, and I felt
> that it wasn't really clear on one aspect of using GDB with gdbserver
> (or any remote target).
> 
> I felt that the text wasn't explicit enough about how a remote target
> can download executables and libraries to GDB, and how GDB can then
> parse these files.  When we consider the sort of bugs we see,
> especially in BFD and the DWARF parser, when it comes to badly
> formatted files, I thought it was worth calling this out.
> ---
>   gdb/SECURITY.txt | 12 ++++++++++++
>   1 file changed, 12 insertions(+)
> 
> diff --git a/gdb/SECURITY.txt b/gdb/SECURITY.txt
> index f4ddebe3f03..63e110055db 100644
> --- a/gdb/SECURITY.txt
> +++ b/gdb/SECURITY.txt
> @@ -210,6 +210,18 @@ Security Realities Of The GDB Project
>     user to protect this connection, for example, by only starting
>     gdbserver within a secure network.
>   
> +  Additionally, when GDB connects to a remote target, it will, by
> +  default, automatically download the executable and shared libraries
> +  from the remote system and parse them locally, without prompting the
> +  user.  This means that the risks described above relating to parsing
> +  malformed executables also apply when performing remote debugging.
> +  If the remote target is untrusted, or the connection to the remote
> +  target is untrusted, malicious or malformed binaries could be served

This is a good guideline, but does not make clear if bugs in this 
processing will be treated as security issues.  This is true for the 
line above as well, which this paragraph intends to augment - it warns 
the user that such behaviour is not good, but does not make a definitive 
statement whether bugs related to them will be treated as security 
issues or not.

> +  to GDB, resulting in any of the issues described above.  Users
> +  should apply the same precautions when performing remote debugging
> +  as when analysing an untrusted binary locally, including running GDB
> +  in a secure, sandboxed environment.
> +
>   Reporting Non-Security Bugs
>   ---------------------------
>