Re: RFC: Fix for CVE-2026-19548
Collin Funk <[email protected]>
| Newsgroups | gmane.comp.gnu.binutils |
|---|---|
| Message-ID | <[email protected]> |
Hans-Peter Nilsson <[email protected]> writes: > On Mon, 17 Aug 2026, Nick Clifton wrote: >> Hi Alan, >> >> > The bug report says: >> > "The vulnerability is triggered when LTO plugins are active >> > (link_info.lto_plugin_active is true) and the input object has >> > abfd->my_archive == NULL" >> > >> > If my_archive is NULL the bfd isn't an archive member! >> >> True - I suspect that this is a theoretical bug, rather than an exploitable >> one. >> >> > How is it that add_archive_element is being called for something that >> > isn't a member of an archive? Do you have a testcase? >> >> No - I was just responding to the CVE - which does not provide a testcase. >> Cheers >> Nick > > Does that mean that the binutils CVE process has an exploitable > flaw in which an opponent can DOS developers with red herring > CVEs? 1/2 :-) Sadly this is pretty much an issue with the entire CVE system in general. You can talk with the CNA and get it marked "disputed", but retracting it pretty much requires the original reporter to agree, which they are unlikely to do. It is probably a better use of time to try to convince people that the CVE system is stupid, instead of trying to dispute all the bogus ones. Collin