Re: RFC: Adding a SECURITY.md document to the Binutils

Paul Koning via Gdb
2023-04-13T16:51:06Z

> On Apr 13, 2023, at 12:02 PM, Siddhesh Poyarekar <siddhesh@gotplt.org> wrote:
>
> On 2023-04-13 11:08, Paul Koning wrote:
>>> On Apr 13, 2023, at 11:02 AM, Siddhesh Poyarekar <siddhesh@gotplt.org> wrote:
>>>
>>> On 2023-04-13 10:50, Richard Earnshaw wrote:
>>>> No, whilst elf can be executed, objdump should never be doing that: it's a tool for examining a file, not running it. You have to have a tool that can safely examine the contents of an elf file or you can never verify it for issues - opening it up in emacs to examine the contents is not the way to do that :)
>>>
>>> You can verify it for issues, in a sandbox.
>>>
>>>> But all that is beside the point. The original case I gave was a /corrupt/ elf file that caused a buffer overrun in the objdump binary.
>>>
>>> ... and that's a robustness issue. Any buffer overrun in any program could in theory be exploited to send out files.
>> No. Buffer overruns are generally recognized as security issues, precisely because they (often) can be used to produce arbitrary code execution exploits.
>
> They're a common security exploit vector, but context matters. If you have local access to a system, you can already execute arbitrary code; a buffer overrun itself is not going to help you do anything that you couldn't already do. By letting in an untrusted file or by accepting inputs over a network, you're opening up a *new* vector to actually exploit the buffer overflow to do something you couldn't already do.

Yes, but...

If someone sends me an executable file, and I execute it and suffer a virus, shame on me. If someone sends me a C source file and I compile and link that BUT DO NOT EXECUTE the resulting executable, and I suffer a virus, shame on the tool.

I don't expect the act of compiling or linking or objdumping to compromise my system's security, any more than I expect the act of editing a text file to do so. The key point is expectation. I'm reminded of a legal rule seen, for example, in "expectation of privacy": I should assume I can be seen when walking around town, but it is valid for me to assume I'm not seen when at home in my bathroom. Similarly, I should assume my system can get attacked when I execute a program, but it is reasonable for me to assume no attack is possible when I run gcc or objdump (or hexdump or cat).

paul