Skip to content

Add llvm-project archive issues for Chromium bug tracker #132030

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
May 21, 2025
Merged

Add llvm-project archive issues for Chromium bug tracker #132030

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ad6181c
Add llvm-project archive issues for Chromium bug tracker
smithp35 Mar 19, 2025
e5d6ac7
Kristof's Review comments
smithp35 Mar 19, 2025
1bd9859
Merge branch 'llvm:main' into transparencyurls
smithp35 Mar 20, 2025
8a41e00
Rebase on 2024 Transparency update
smithp35 Mar 20, 2025
f096afc
Updated to use both original, redirect and archive URLs.
smithp35 May 20, 2025
8ba6ff5
Fix typo . the -> . The
smithp35 May 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
78 changes: 48 additions & 30 deletions llvm/docs/SecurityTransparencyReports.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,15 @@
LLVM Security Group Transparency Reports
Copy link
Contributor

@tuliom tuliom Mar 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is probably beyond the scope of this PR, but it looks like the name of the group needs to be updated in the title.

Copy link
Collaborator Author

@smithp35 smithp35 Mar 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I thought about updating it, but had enough doubts to not do it in this PR.

========================================

This page lists the yearly LLVM Security group transparency reports.
This page lists the yearly LLVM Security Response group transparency reports.

The LLVM Security Response group started out as the LLVM security group, previous
year's transparency reports keep the original year.

Initially the Chromium issue tracker was used to record issues. This component
has been archived and is read-only. A llvm-project issue with the SecurityArchive
label has been created with a further backup PDF copy in a llvm-project
repository.

2021
----
Expand All @@ -29,8 +37,11 @@ In 2021, the security group received 13 issue reports that were made publicly
visible before 31st of December 2021. The security group judged 2 of these
reports to be security issues:

* https://bugs.chromium.org/p/llvm/issues/detail?id=5
* https://bugs.chromium.org/p/llvm/issues/detail?id=11
* https://issuetracker.google.com/issues/42410043 archive:
Copy link
Collaborator

@kbeyls kbeyls Mar 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it might be good to keep the original bugs.chromium.org urls, so that mapping from original chromium id remains possible. But this is only a weakly held opinion on my part...

Copy link
Collaborator Author

@smithp35 smithp35 Mar 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll have a think about this. For the newly created bugs I chose the redirected URL as that's what people will see when they click on the link. Which makes it easier to cross check.

Happy to change back if there's a consensus, I think I'll need to update the links in the llvm-project issues too.

Copy link
Collaborator Author

@smithp35 smithp35 Mar 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've updated all the Github issues I've created to contain the original URLs. Current form using #131849 as an example:

This is an archival issue from the Security Group's Chromium bug-tracker which has now been archived. Capturing the contents of the Chromium issue in a PDF in case link.

https://issuetracker.google.com/u/1/issues/42410036 (Previous URL https://bugs.chromium.org/p/llvm/issues/detail?id=43) Vulnerable Version of xml2js Used in MLIR Manifest File

Published in https://llvm.org/docs/SecurityTransparencyReports.html#id3

[Vulnerable Version of xml2js Used in MLIR Manifest File [42410036] - Issue Tracker.pdf](https://github.com/user-attachments/files/19323328/Vulnerable.Version.of.xml2js.Used.in.MLIR.Manifest.File.42410036.-.Issue.Tracker.pdf)

Copy link
Collaborator Author

@smithp35 smithp35 May 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To resolve the original vs redirect URL I've found a way to include both for each issue. This does have the advantage that it is easier to check all the URLs are correct and refer to the same issue. I've double checked all the URLs with a redirect against the details in the archive.

https://github.com/llvm/llvm-project/issues/125709

* https://issuetracker.google.com/issues/42410002 archive:
https://github.com/llvm/llvm-project/issues/127644

Both issues were addressed with source changes: #5 in clangd/vscode-clangd, and
#11 in llvm-project. No dedicated LLVM release was made for either.
Expand All @@ -54,24 +65,27 @@ the time of writing this transparency report.

5 of these were judged to be security issues:

* https://bugs.chromium.org/p/llvm/issues/detail?id=17 reports a miscompile in
* https://issuetracker.google.com/issues/42410008 reports a miscompile in
LLVM that can result in the frame pointer and return address being
overwritten. This was fixed.
overwritten. This was fixed. Archive: https://github.com/llvm/llvm-project/issues/127645

* https://bugs.chromium.org/p/llvm/issues/detail?id=19 reports a vulnerability
in `std::filesystem::remove_all` in libc++. This was fixed.
* https://issuetracker.google.com/issues/42410010 reports a vulnerability
in `std::filesystem::remove_all` in libc++. This was fixed. Archive:
https://github.com/llvm/llvm-project/issues/127647

* https://bugs.chromium.org/p/llvm/issues/detail?id=23 reports a new Spectre
* https://issuetracker.google.com/issues/42410015 reports a new Spectre
gadget variant that Speculative Load Hardening (SLH) does not mitigate. No
extension to SLH was implemented to also mitigate against this variant.
Archive: https://github.com/llvm/llvm-project/issues/127648

* https://bugs.chromium.org/p/llvm/issues/detail?id=30 reports missing memory
* https://issuetracker.google.com/issues/42410023 reports missing memory
safety protection on the (C++) exception handling path. A number of fixes
were implemented.
were implemented. Archive: https://github.com/llvm/llvm-project/issues/127649

* https://bugs.chromium.org/p/llvm/issues/detail?id=33 reports the RETBLEED
* https://issuetracker.google.com/issues/42410026 reports the RETBLEED
vulnerability. The outcome was clang growing a new security hardening feature
`-mfunction-return=thunk-extern`, see https://reviews.llvm.org/D129572.
Archive: https://github.com/llvm/llvm-project/issues/127650


No dedicated LLVM releases were made for any of the above issues.
Expand All @@ -84,33 +98,37 @@ that were received earlier, but were disclosed in 2023.

9 of these were judged to be security issues:

https://bugs.chromium.org/p/llvm/issues/detail?id=36 reports the presence of
.git folder in https://llvm.org/.git.
* https://issuetracker.google.com/issues/42410029 reports the presence of
.git folder in https://llvm.org/.git. Archive: https://github.com/llvm/llvm-project/issues/131841

https://bugs.chromium.org/p/llvm/issues/detail?id=66 reports the presence of
a GitHub Personal Access token in a DockerHub imaage.
* https://issuetracker.google.com/issues/42410060 reports the presence of
a GitHub Personal Access token in a DockerHub imaage. Archive: https://github.com/llvm/llvm-project/issues/131846

https://bugs.chromium.org/p/llvm/issues/detail?id=42 reports a potential gap
in the Armv8.1-m BTI protection, involving a combination of large switch statements
and __builtin_unreachable() in the default case.
* https://issuetracker.google.com/issues/42410035 reports a potential gap
in the Armv8.1-m BTI protection, involving a combination of large switch statements
and __builtin_unreachable() in the default case. Archive: https://github.com/llvm/llvm-project/issues/131848

https://bugs.chromium.org/p/llvm/issues/detail?id=43 reports a dependency
on an old version of xml2js with a CVE filed against it.
* https://issuetracker.google.com/issues/42410036 reports a dependency on
an old version of xml2js with a CVE filed against it.
Archive: https://github.com/llvm/llvm-project/issues/131849

https://bugs.chromium.org/p/llvm/issues/detail?id=45 reports a number of
dependencies that have had vulnerabilities reported against them.
* https://issuetracker.google.com/issues/42410038 reports a number of
dependencies that have had vulnerabilities reported against them.
Archive: https://github.com/llvm/llvm-project/issues/131851

https://bugs.chromium.org/p/llvm/issues/detail?id=46 is related to issue 43.
* https://issuetracker.google.com/issues/42410039 is related to issue 42410038.
Archive: https://github.com/llvm/llvm-project/issues/131852

https://bugs.chromium.org/p/llvm/issues/detail?id=48 reports a buffer overflow
in std::format from -fexperimental-library.
* https://issuetracker.google.com/issues/42410041 reports a buffer overflow
in std::format from -fexperimental-library. Archive: https://github.com/llvm/llvm-project/issues/131856

https://bugs.chromium.org/p/llvm/issues/detail?id=54 reports a memory leak in
basic_string move assignment when built with libc++ versions <=6.0 and run against
newer libc++ shared/dylibs.
* https://issuetracker.google.com/issues/42410047 reports a memory leak in
basic_string move assignment when built with libc++ versions <=6.0 and run against
newer libc++ shared/dylibs. Archive: https://github.com/llvm/llvm-project/issues/131857

https://bugs.chromium.org/p/llvm/issues/detail?id=56 reports an out of bounds buffer
store introduced by LLVM backends, that regressed due to a procedural oversight.
* https://issuetracker.google.com/issues/42410049 reports an out of bounds buffer
store introduced by LLVM backends, that regressed due to a procedural oversight.
Archive: https://github.com/llvm/llvm-project/issues/131858

No dedicated LLVM releases were made for any of the above issues.

Expand Down
Loading