Re: RFC: Adding a SECURITY.md document to the Binutils

On 2023-04-12 23:51, Alan Modra wrote:
> On Wed, Apr 12, 2023 at 01:10:01PM -0400, Siddhesh Poyarekar wrote:
>> OK, then how about this for the first paragraph:
>>
>> ~~~
>> A security bug is one that threatens the security of a system or network.
>> In the context of GNU Binutils, there are two ways in which a bug could have
>> security consequences. The primary method is when the tools introduce a
>> vulnerability in the output file that was not present in the input files
>> being processed.  The other, albeit unlikely way is when a bug in the tools
>> results in a privilege boundary is crossed in either the tools themselves or
>> in the code they generate.
>> ~~~
> 
> I don't see that talking about privilege boundaries is particularly
> relevant.  Consider this:
> 
> It is trivially easy to craft an object file that when examined with
> objdump will read your ssh private keys.  That's not a bug, it's a
> feature of thin archives.
> 
> Now all you need is some means of delivering those private keys, and
> I'm sure there are plenty of buffer overflows in libbfd waiting to be
> exploited, especially with --enable-targets=all.

That's not a crossing of privilege boundaries; ssh private keys are 
owned by the executing user.  A crossing of privilege boundaries implies 
being able to do something that one wasn't previously able to do, like 
reading files not owned by the executing user.

Sid