Re: RFC: Adding a SECURITY.md document to the Binutils

[Paul Koning via Gdb <gdb@sourceware.org>]

> On Apr 13, 2023, at 1:29 PM, Siddhesh Poyarekar <siddhesh@gotplt.org> wrote:
> 
> On 2023-04-13 13:05, Paul Koning wrote:
>>> On Apr 13, 2023, at 1:00 PM, Siddhesh Poyarekar <siddhesh@gotplt.org> wrote:
>>> 
>>> On 2023-04-13 12:49, Paul Koning wrote:
>>>> If someone sends me an executable file, and I execute it and suffer a virus, shame on me.  If someone sends me a C source file and I compile and link that BUT DO NOT EXECUTE the resulting executable, and I suffer a virus, shame on the tool.
>>> 
>>> If someone sends me a C source file and I compile and link it without inspecting it first, then definitely shame on me again.  Compilers and linkers assume *trusted* input.
>> That's news to me.
>> It is true that not all text is valid C, and some text has "undefined" behavior.  But "undefined" is a property of the resulting executable program, NOT of the act of compiling it.  I have never before seen anyone suggest that submitting a bad program to a compiler could reasonably be expected to result in that compiler attacking the security of your system, or that if it did so it wouldn't be a security bug in that compiler.
> 
> I haven't seen anyone suggest (and have seen many balk at) the idea of crashes/buffer overruns in compilers being considered security issues. 

Not all buffer overruns cause security issues.  Those that crash the program with the buffer overrun are not security issues (unless you're considering the category of Denial of Service attacks).  But a buffer overrun that enables the execution of arbitrary code IS a security issue.

Who do you know to "balk at" that principle?

This is no different from how one analyzes buffer overruns in networking applications.  If the consequence of the error is nothing worse than an abort of that application, it's DoS and would typically not be considered serious.  If it allows code to be inserted and executed in the context of the application, then that is serious and is a security defect.  The same goes for any other application whose specification says that it processes -- but does not execute -- its inputs.

	paul