RFC: Extending the Glibc CNA to handle GNU Binutils CVEs

[Jose E. Marchesi]

> Hi Guys,
>
> Over the last decade or so almost all of the Binutils bugs which have
> achieved Common Vulnerability and Exposures [1] status have been
> bogus.  In the sense they whilst they are bugs, they are not ones that
> could be exploited by an attacker to compromise a system or a network.
> This is a problem - for me and for other people who maintain the
> binutils package in distributions - because any CVE that gets filed
> has to be carefully examined and potentially will cause a lot of work
> back-porting the fix to all the supported releases.
>
> Recent updates to the SECURITY.txt document should help to reduce the
> number of CVEs that actually have to be fixed by distribution
> maintainers but it would be better if the CVEs were never created in
> the first place.
>
> To this end therefore we are looking into extending the scope of the
> current glibc CVE Numbering Authority [2] so that it will also handle
> Binutils bugs.  This should be a relatively process and it would mean
> that the glibc CNA security team can review submitted binutils bug
> reports and actually decide if they really do meet the criteria for
> being assigned a CVE rating.  It will also help that the glibc folks
> are familiar with the binutils and what the tools do.
>
> My question to you guys then is:
>
>   * Are there any concerns or objections to this idea ?

I think this would be great.. provided the glibc CNA chaps are willing
to do it, of course 8-)

> Cheers
>   Nick
>
> PS. Extending the scope of the CNA will also mean that there is the
> possibility for interested contributors to become members of the CNA
> security review team.  (It looks really good on a C.V.)
>
> PPS. In the future, if this change is successful, it may also be
> possible to extend the CNA to cover GCC and GDB.  In that way we could
> have the whole toolchain covered by knowledgeable reviewers who can
> make sure that when a CVE is assigned, it really does represent a
> threat that needs to fixed as quickly and as widely as possible.

Yeah!

>
>
> [1] - https://www.cve.org/
> [2] - https://www.cve.org/PartnerInformation/ListofPartners/partner/glibc