A backdoor in xz [LWN.net]

A backdoor in xz

Posted Mar 30, 2024 13:24 UTC (Sat) by pawel44 (guest, #162008)
In reply to: A backdoor in xz by dvdeug
Parent article: A backdoor in xz

Kernel is not pulling third party dependencies.

to post comments

A backdoor in xz

Posted Mar 30, 2024 14:38 UTC (Sat) by smurf (subscriber, #17840) [Link] (1 responses)

Well, not when building it. Running it is another matter, as it pulls in a heap of pre-built binaries (firmware) with poorly-documented provenance.

A backdoor in xz

Posted Mar 30, 2024 15:05 UTC (Sat) by marcH (subscriber, #57642) [Link]

Running it is another matter, as it pulls in a heap of pre-built binaries (firmware) with poorly-documented provenance.

Even worse: it does not even _log_ what it loaded! I usually carry this hack:

--- a/drivers/base/firmware_loader/main.c
+++ b/drivers/base/firmware_loader/main.c
@@ -562,7 +562,7 @@ fw_get_filesystem_firmware(struct device *device, struct fw_priv *fw_priv,
                size = rc;
                rc = 0;
 
-               dev_dbg(device, "Loading firmware from %s\n", path);
+               dev_warn(device, "XXXX Loading firmware from %s\n", path); 
                if (decompress) {
                        dev_dbg(device, "f/w decompressing %s\n",
                                fw_priv->fw_name);
@@ -924,6 +924,10 @@ _request_firmware(const struct firmware **firmware_p, const char *name,
                fw_log_firmware_info(fw, name, device);
        }
 
+       dev_warn(device, "XXXX request-firmware name=%s, ret=%d\n",   name, ret);

        *firmware_p = fw;
        return ret;
 }