Brief items

A backdoor in xz

Andres Freund has posted a detailed investigation into a backdoor that was shipped with versions 5.6.0 and 5.6.1 of the xz compression utility. It appears that the malicious code may be aimed at allowing SSH authentication to be bypassed.

I have not yet analyzed precisely what is being checked for in the injected code, to allow unauthorized access. Since this is running in a pre-authentication context, it seems likely to allow some form of access or other form of remote code execution.

The affected versions are not yet widely shipped, but checking systems for the bad version would be a good idea.

Update: there are advisories out now from Arch, Debian, Red Hat, and openSUSE.

A further update from openSUSE:

For our openSUSE Tumbleweed users where SSH is exposed to the internet we recommend installing fresh, as it’s unknown if the backdoor has been exploited. Due to the sophisticated nature of the backdoor an on-system detection of a breach is likely not possible. Also rotation of any credentials that could have been fetched from the system is highly recommended.

Comments (408 posted)

A few relevant quotes

I'm on a holiday and only happened to look at my emails and it seems to be a major mess.

— Lasse Collin

The reality that we are struggling with is that the free software infrastructure on which much of computing runs is massively and painfully underfunded by society as a whole, and is almost entirely dependent on random people maintaining things in their free time because they find it fun, many of whom are close to burnout. This is, in many ways, the true root cause of this entire event.

— Russ Allbery

Incredible work from Andres. The attackers made a serious strategic mistake: they made PostgreSQL slightly slower.

— Thomas Munro

There is no way to discuss this in public without turning a single malicious entity into 10 000 malicious entities once the information is widely known.

Making sure the impact and mitigations are known before posting this publicly so that everyone knows what to do before the 10 000 malicious entities start attacking is just common sense.

— Marc Deslauriers

Again the FOSS world has proven to be vigilant and proactive in finding bugs and backdoors, IMHO. The level of transparency is stellar, especially compared to proprietary software companies. What the FOSS world has accomplished in 24 hours after detection of the backdoor code in #xz deserves a moment of humbleness. Instead we have flamewars and armchair experts shouting that we must change everything NOW. Which would introduce even more risks. Progress is made iteratively. Learn, adapt, repeat.

— Jan Wildeboer

Comments (122 posted)

Kernel release status

The current development kernel is 6.9-rc2, released on March 31. Linus said: "Neither snow nor rain nor heat nor gloom of night stays kernel rc releases. Nor does Easter."

Stable updates: 6.8.3, 6.7.12, 6.6.24, and 6.1.84 were released in April 3. Note that 6.7.12 is the final release for the 6.7.y series, and that branch is now end-of-life.

Comments (none posted)

Quote of the week

But when I say "compiler writers don't understand memory ordering", it's not that I think they need to be singled out - pretty much *nobody* understands it.

Christ, I'm supposed to know it fairly well, and I still get it wrong myself regularly and have to really think about it (and honestly just prefer leaning on a few standard patterns rather than having to think about it too much).

— Linus Torvalds

Comments (none posted)

AlmaLinux OS - CVE-2024-1086 and XZ (AlmaLinux blog)

AlmaLinux has announced updated kernels for AlmaLinux 8 and 9 to address CVE-2024-1086, a use-after-free vulnerability in the kernel that could be exploited to gain local privilege escalation. This is notable because the fix marks a divergence between AlmaLinux and Red Hat Enterprise Linux (RHEL):

In January of this year, a kernel flaw was disclosed and named CVE-2024-1086. This flaw is trivially exploitable on most RHEL-equivalent systems. There are many proof-of-concept posts available now, including one from our Infrastructure team lead, Jonathan Wright (Dealing with CVE-2024-1086). In multi-user scenarios, this flaw is especially problematic.

Though this was flagged as something to be fixed in Red Hat Enterprise Linux, Red Hat has only rated this as a moderate impact.

The AlmaLinux project would also like to note that it is not impacted by the XZ backdoor. "Because enterprise Linux takes a bit longer to adopt those updates (sometimes to the chagrin of our users), the version of XZ that had the back door inserted hadn't made it further than Fedora in our ecosystem."

Comments (4 posted)

Schaller: Fedora Workstation 40 – what are we working on

Christian Schaller writes about the desktop-oriented work aimed at the upcoming Fedora 40 release.

Another major feature landing in Fedora Workstation 40 that Jonas Ådahl and Ray Strode has spent a lot of effort on is finalizing the remote desktop support for GNOME on Wayland. So there has been support for remote connections for already logged in sessions already, but with these updates you can do the login remotely too and thus the session do not need to be started already on the remote machine. This work will also enable 3rd party solutions to do remote logins on Wayland systems, so while I am not at liberty to mention names, be on the lookout for more 3rd party Wayland remoting software becoming available this year.

Comments (17 posted)

KDE6 release: D-Bus and Polkit Galore (SUSE security team blog)

The SUSE Security Team Blog is carrying a detailed article on SUSE's review of the KDE6 release.

The SUSE security team restricts the installation of system wide D-Bus services and Polkit policies in openSUSE distributions and derived SUSE products. Any package that ships these features needs to be reviewed by us first, before it can be added to production repositories.

In November, openSUSE KDE packagers approached us with a long list of KDE components for an upcoming KDE6 major release. The packages needed adjusted D-Bus and Polkit whitelistings due to renamed interfaces or other breaking changes. Looking into this many components at once was a unique experience that also led to new insights, which will be discussed in this article.

Comments (1 posted)

NetBSD 10.0 released

Version 10.0 of the NetBSD system has been released.

The netbsd-10 release branch is more than a year old now, so it is high time the 10.0 release makes it to the front stage. This matches the long time it took for the development branch to get ready for branching, a lot of development went into this new release.

This also caused the release announcement to be one of the longest we ever did.

As might be imagined, there are a lot of changes; see the above-mentioned release announcement for the details.

Full Story (comments: 10)

Distributions quotes of the week

Getting distros to work together is hard. People choose their distros like they choose their sports teams. When they see another distro doing something, their first reaction is to do the opposite. This is why it takes a long time to get changes done and it takes a lot of people time to make it happen.

— Stephen Smoogen

My impression is that all of this was well planned and they were in it for the long haul. They had no reason to stop with backdooring ssh, except for the risk of additional exposure. But they decided to take that risk, with the sandbox disabling. So they planned to do more, and every commit by "Jia Tan", and really every commit that they could have influenced needs to be distrusted.

This is why I've suggested to Debian that they revert to an earlier version of xz. That would be my advice to anyone distributing xz.

— Joey Hess

I think the biggest issue is that we are pretty much based on a model that relies on trusting upstreams, for code, for license and copyright compliance, etc. We tend to assume upstreams (and us!) can make mistakes, but that in general they are not working against us.

When confronted with a known hostile (and not necessarily malicious) upstream the only winning game is not to play.

— Guillem Jover

We have no mechanism to flag when J. Random Packager adds "Supplements: glibc" to their random leaf node package. As a reminder, *we are a project that allows 1,601 minimally-vetted people to deliver arbitrary code executed as root on hundreds of thousands of systems*, and this mechanism allows any one of those people to cause the package they have complete control over to be automatically pulled in as a dependency on virtually every single one of those systems.

— Adam Williamson

Comments (none posted)

Malcolm: Improvements to static analysis in the GCC 14 compiler

David Malcolm writes about some static-analyzer features that are coming in the GCC 14 release.

Solving the halting problem?

Obviously I'm kidding with the title here, but for GCC 14 I've implemented a new warning: -Wanalyzer-infinite-loop that's able to detect some simple cases of infinite loops.

See also: this report from the 2023 GNU Tools Cauldron.

Comments (none posted)

Redict 7.3.0 released

The first stable release of Redict, a fork of the Redis in-memory database under a copyleft license, has been announced.

You may be wondering why Redict would be of interest to you, particularly when compared with Valkey, another Redis fork that was announced on Thursday.

In technical terms, we are focusing on stability and long-term maintenance, and on achieving excellence within our current scope. We believe that Redict is near feature-complete and that it is more valuable to our users if we take a conservative stance to innovation and focus on long-term reliability instead. This is in part a choice we've made to distinguish ourselves from Valkey, whose commercial interests are able to invest more resources into developing more radical innovations, but also an acknowledgement of a cultural difference between our projects, in that the folks behind Redict place greater emphasis on software with a finite scope and ambitions towards long-term stability rather than focusing on long-term growth in scope and complexity.

Comments (none posted)

Samba 4.20.0 released

Version 4.20.0 of the Samba Windows interoperability suite has been released. Changes include better support for group-managed service accounts, an experimental Windows search protocol client, support for conditional access control entries, and more.

Full Story (comments: 7)