Re: [SECURITY] Async-signal-unsafe operations in alrm_catcher() signal handler

Sam James <[email protected]> writes:

> How is that different from just letting the process exit otherwise?
> ~/.bash_logout will be used either way. If a process writes to arbitrary
> bash init files, then all bets are off.

Sadly, if this reporter is determined to assign a CVE to this, I don't
think they will run into issues. A word of caution that it is not
worthwhile to try to resolve that if they do.

I've made similar arguments to the reporter and CNA who had
CVE-2026-53910 assigned to 'diff3' in diffutils. It requires a user to
provide a bogus script to --diff3-program (which necessitates them being
able to execute arbitrary code). The only results they demonstrated were
that 'diff3' would exit with a non-zero exit status by crashing, when
the "fixed" version does the same thing anyways but gracefully.

Of course, that has been the least productive time I have spent in my
life, and they refuse to retract it or remove the random mention of
"remote code execution" in the description.

> The signal handler should be made async-safe, but I don't think there's
> any vulnerability here.

Agreed.

Collin