Re: RFC: Adding a SECURITY.md document to the Binutils

Siddhesh Poyarekar
2023-04-13T04:26:09Z

On 2023-04-12 23:51, Alan Modra wrote:
> On Wed, Apr 12, 2023 at 01:10:01PM -0400, Siddhesh Poyarekar wrote:
>> OK, then how about this for the first paragraph:
>>
>> ~~~
>> A security bug is one that threatens the security of a system or network.
>> In the context of GNU Binutils, there are two ways in which a bug could have
>> security consequences. The primary method is when the tools introduce a
>> vulnerability in the output file that was not present in the input files
>> being processed. The other, albeit unlikely way is when a bug in the tools
>> results in a privilege boundary is crossed in either the tools themselves or
>> in the code they generate.
>> ~~~
>
> I don't see that talking about privilege boundaries is particularly
> relevant. Consider this:
>
> It is trivially easy to craft an object file that when examined with
> objdump will read your ssh private keys. That's not a bug, it's a
> feature of thin archives.
>
> Now all you need is some means of delivering those private keys, and
> I'm sure there are plenty of buffer overflows in libbfd waiting to be
> exploited, especially with --enable-targets=all.

That's not a crossing of privilege boundaries; ssh private keys are
owned by the executing user. A crossing of privilege boundaries implies
being able to do something that one wasn't previously able to do, like
reading files not owned by the executing user.

Sid