Does commit c2bf7de1 fix CVE-2026-3441 and CVE-2026-3442?

[Xi Ruoyao]

On Mon, 2026-06-22 at 11:06 +0000, Dora, Sunil Kumar via Binutils wrote:
> 
> Hi,
> 
> 
> I'm looking at commit c2bf7de1eb7
> ("xcofflink buffer overflows") for a downstream update and want to tag
> it correctly.
> 
> 
> The diff fixes two out-of-bounds reads in xcoff_link_add_symbols: the
> x_scnlen index check and the r_symndx check. That looks like it
> matches Red Hat'sCVE-2026-3441 and CVE-2026-3442 (bugs 2443826 and
> 2443828).


Per the binutils security policy:

    The tools assume that the input is to be trusted.  If this is not 
    the case then the tools should be run inside a sandboxed
    environment to ensure that they do not compromise the host
    environment.  In the context of this document then a bug which
    relies upon using untrusted input, eg a crafted binary, must show
    that the result is a breach of trust boundary, e.g. being able to
    execute code as another user or root, or escape from the sandboxed
    environment.  If this is not possible then the bug will not be
    considered a security bug.

Thus a buffer overflow handling a crafted input file is not considered a
security issue, so it should not have been assigned the CVE in the first
place.


-- 
Xi Ruoyao <xry111@xry111.site>