FreeChainXenon/gcc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SECURITY.txt: Drop "exploitable" in reference to hardening issues

Browse source 
The "exploitable vulnerability" may lead to a misunderstanding that
missed hardening issues are considered vulnerabilities, just that
they're not exploitable.  This is not true, since while hardening bugs
may be security-relevant, the absence of hardening does not make a
program any more vulnerable to exploits than without.

Drop the "exploitable" word to make it clear that missed hardening is
not considered a vulnerability.

Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>

ChangeLog:

	* SECURITY.txt: Drop "exploitable" in the hardening section.
This commit is contained in:
Siddhesh Poyarekar 2023-12-18 09:35:06 -05:00
parent b7e5a29602
commit e9f2c6d260
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
SECURITY.txt
View file

@ -155,10 +155,10 @@ Security features implemented in GCC
GCC implements a number of security features that reduce the impact GCC implements a number of security features that reduce the impact
of security issues in applications, such as -fstack-protector, of security issues in applications, such as -fstack-protector,
-fstack-clash-protection, _FORTIFY_SOURCE and so on. A failure of -fstack-clash-protection, _FORTIFY_SOURCE and so on. A failure of
these features to function perfectly in all situations is not an these features to function perfectly in all situations is not a
exploitable vulnerability in itself since it does not affect the vulnerability in itself since it does not affect the correctness of
correctness of programs. Further, they're dependent on heuristics programs. Further, they're dependent on heuristics and may not
and may not always have full coverage for protection. always have full coverage for protection.
Similarly, GCC may transform code in a way that the correctness of Similarly, GCC may transform code in a way that the correctness of
the expressed algorithm is preserved, but supplementary properties the expressed algorithm is preserved, but supplementary properties