RFC: Extending the Glibc CNA to handle GNU Binutils CVEs

[Sam James]

Nick Clifton <nickc@redhat.com> writes:

> Hi Guys,

Hi Nick,

>
> Over the last decade or so almost all of the Binutils bugs which have
> achieved Common Vulnerability and Exposures [1] status have been
> bogus.  In the sense they whilst they are bugs, they are not ones that
> could be exploited by an attacker to compromise a system or a network.
> This is a problem - for me and for other people who maintain the
> binutils package in distributions - because any CVE that gets filed
> has to be carefully examined and potentially will cause a lot of work
> back-porting the fix to all the supported releases.
>
> Recent updates to the SECURITY.txt document should help to reduce the
> number of CVEs that actually have to be fixed by distribution
> maintainers but it would be better if the CVEs were never created in
> the first place.
>
> To this end therefore we are looking into extending the scope of the
> current glibc CVE Numbering Authority [2] so that it will also handle
> Binutils bugs.  This should be a relatively process and it would mean
> that the glibc CNA security team can review submitted binutils bug
> reports and actually decide if they really do meet the criteria for
> being assigned a CVE rating.  It will also help that the glibc folks
> are familiar with the binutils and what the tools do.
>
> My question to you guys then is:
>
>   * Are there any concerns or objections to this idea ?

I'm on board with the idea, as long as the intent is to reject many of
the things which currently get CVEs assigned, as they do not agree with
our SECURTIY.txt policy.

Also of course assuming the team has room to support us. But it sounds
like it could help and avoid downstreams wasting time on bogus
CVEs. They've been a problem for years but it got worse like with all
projects lately thanks to recent developments.

>
> Cheers
>   Nick
>
> PS. Extending the scope of the CNA will also mean that there is the
> possibility for interested contributors to become members of the CNA
> security review team.  (It looks really good on a C.V.)
>
> PPS. In the future, if this change is successful, it may also be
> possible to extend the CNA to cover GCC and GDB.  In that way we could
> have the whole toolchain covered by knowledgeable reviewers who can
> make sure that when a CVE is assigned, it really does represent a
> threat that needs to fixed as quickly and as widely as possible.

Yes, this is a great point.

>
>
> [1] - https://www.cve.org/
> [2] - https://www.cve.org/PartnerInformation/ListofPartners/partner/glibc

sam
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 418 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/binutils/attachments/20260610/79a3ad01/attachment.sig>