xz-5.6.x is trojaned (CVE-2024-3094) #300055

dfoxfranke · 2024-03-29T18:52:54Z

See https://www.openwall.com/lists/oss-security/2024/03/29/4.

The trojaned source package is not in 23.11 but has been in unstable since 5c7c19c. I'm trying to verify whether NixOS users are impacted by the exploit. I think we may be okay because NixOS doesn't have the openssh patch for systemd notification, and therefore openssh has no hook into liblzma.

The text was updated successfully, but these errors were encountered:

dfoxfranke · 2024-03-29T19:00:56Z

@svanderburg @trofi

jaen · 2024-03-29T19:08:33Z

Hopefully that means we're not directly impacted?

Observed requirements for the exploit:
(...)
b) argv[0] needs to be /usr/sbin/sshd

Ulexus · 2024-03-29T19:12:56Z

FWIW, the openwall email indicates that the Github autogenerated tarball does not have the exploit in it. I would imagine we could just switch to that instead of the tarball artifacts, as an immediate-term fix.

RossComputerGuy · 2024-03-29T19:20:53Z

@jaen Likely we could be impacted still, I thought they tested on Debian which obviously uses the standard FHS and not the Nix one. I don't think what the argv0 dirname part of the path is matters exactly, as long as it is sshd.

trofi · 2024-03-29T19:26:04Z

Yes. Being handled in #300028

Aleksanaa · 2024-03-29T19:34:10Z

sshd on NixOS is (probably?) not affected according to the bash script from the bottom of that mail.

NightH4nter · 2024-03-29T19:41:55Z

sshd on NixOS is (probably?) not affected according to the bash script from the bottom of that mail.

i ran it without modifying, and it did output nothing for me. it should say "probably unaffected" or something like that

Aleksanaa · 2024-03-29T19:46:51Z

sshd on NixOS is (probably?) not affected according to the bash script from the bottom of that mail.

without modifying it, it outputs nothing for me, and it should say "probably unaffected" or something like that

ldd $(which sshd) | grep liblzma failed. We don't seem to pull in xz as a dependency of openssh, though.

ChanceHarrison · 2024-03-29T19:49:20Z

@NightH4nter: Much to what @Aleksanaa said, liblzma isn't a shared library of sshd (edit: dangerous generalization, I should say in nixpkgs), the lack of output from the linked detect.sh is because:

P.S. in the detect.sh script, the "set -eu" line plays a bad trick: it aborts the check if sshd is not actually linked to liblzma. (from oss-sec thread)

Lymia · 2024-03-29T19:55:10Z

From what's been posted online, it sounds like this particular backdoor seems to only try to inject stuff into .rpm and .deb builds of XZ. Biggest worry for nixos is whether previous versions had other backdoors too.

panchoh · 2024-03-29T20:07:03Z

To facilitate searches: CVE-2024-3094.

Aleksanaa · 2024-03-29T20:09:55Z

To further facilitate searches:

oss-security mailing list: https://www.openwall.com/lists/oss-security/2024/03/29/4

debian-security-announce mailing list: https://lists.debian.org/debian-security-announce/2024/msg00057.html

CVE: https://www.cve.org/CVERecord?id=CVE-2024-3094

NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-3094

GitHub Advisory Database: GHSA-rxwq-x6h5-x525

Red Hat Customer Portal: https://access.redhat.com/security/cve/CVE-2024-3094

Red Hat Blog: https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users

Red Hat Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-3094

Debian Security Bug Tracker: https://security-tracker.debian.org/tracker/CVE-2024-3094

SUSE Security: https://www.suse.com/security/cve/CVE-2024-3094.html

SUSE Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-3094

Gentoo's Bugzilla: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2024-3094

Arch Linux News: https://archlinux.org/news/the-xz-package-has-been-backdoored/

Arch Linux Advisories: https://security.archlinux.org/ASA-202403-1

(src https://t.me/c/1265053468/199141)

LeSuisse · 2024-03-30T00:05:01Z

NixOS discourse thread: https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405

viraptor · 2024-03-30T03:55:44Z

FWIW, the openwall email indicates that the Github autogenerated tarball does not have the exploit in it. I would imagine we could just switch to that instead of the tarball artifacts, as an immediate-term fix.

Sounds like a good idea. But currently the whole https://github.com/tukaani-project/xz/ is taken down, so we'll need some other source of this code. (this will currently break rebuilding from scratch in interesting ways...)

NightH4nter · 2024-03-30T07:28:39Z

@NightH4nter: Much to what @Aleksanaa said, liblzma isn't a shared library of sshd (edit: dangerous generalization, I should say in nixpkgs), the lack of output from the linked detect.sh is because:

P.S. in the detect.sh script, the "set -eu" line plays a bad trick: it aborts the check if sshd is not actually linked to liblzma. (from oss-sec thread)

sure. but i would assume other binaries linked against infected liblzma might be a subject to discussion

…suspected. See NixOS/nixpkgs#300055

jwillikers · 2024-03-30T14:12:30Z

FWIW, the openwall email indicates that the Github autogenerated tarball does not have the exploit in it. I would imagine we could just switch to that instead of the tarball artifacts, as an immediate-term fix.

Sounds like a good idea. But currently the whole https://github.com/tukaani-project/xz/ is taken down, so we'll need some other source of this code. (this will currently break rebuilding from scratch in interesting ways...)

Source is available here: https://git.tukaani.org/

See the update from the primary author, too: https://tukaani.org/xz-backdoor/

dfoxfranke · 2024-03-30T15:46:09Z

Lasse Collin added this commit a few hours ago: https://git.tukaani.org/?p=xz.git;a=commit;h=f9cf4c05edd14dedfe63833f8ccbe41b55823b00

which appears to demonstrate that Tan made at least one subversive commit to the xz git repo, and not just to the release tarballs. However, the subversive commit is recent, made between 5.6.0 and 5.6.1: https://git.tukaani.org/?p=xz.git;a=commit;h=328c52da8a2bbb81307644efdb58db2c422d9ba7. Hence, so far, there is no evidence that versions of xz prior to 5.6.0 are compromised in any way.

'cause wat the fuck anying eta: - <https://www.reddit.com/r/ProgrammerHumor/comments/1bqwlg6/dontactsusyoujustcompromisedssh/> - <NixOS/nixpkgs#300055> - lanjutin sayanggg

chushuai · 2024-03-30T18:08:50Z

This package cannot be downloaded anymore！！！
https://github.com/tukaani-project/xz/releases/download/v${version}/xz-${version}.tar.bz2"

Aleksanaa · 2024-03-30T18:22:00Z

This package cannot be downloaded anymore！！！ https://github.com/tukaani-project/xz/releases/download/v${version}/xz-${version}.tar.bz2"

The link has been changed in 6aa50d0, and will be merged as a part of #298548.

Atry · 2024-03-30T20:29:50Z

Unlike other Linux distribution, where stable releases are preferred, nixos-unstable is widely used by Nix community, especially flakes.
I think it is worth to announce this CVE and recommend any projects depending on nixpkgs between #291205 and #300028 to switch to a different nixpkgs revision.

panchoh · 2024-03-30T22:12:55Z

Timeline of the events, with lots of relevant pointers.

'cause wat the fuck anying eta: - <https://www.reddit.com/r/ProgrammerHumor/comments/1bqwlg6/dontactsusyoujustcompromisedssh/> - <NixOS/nixpkgs#300055> - lanjutin sayanggg

7c6f434c · 2024-04-03T15:55:40Z

2015 is way before the rollback target, 2020 DoS is kind of «what compression ratio is a zip bomb» flamewar.

Hm, 2022 CVE is indeed a patch we'd need to import (and as it was initially reported for zgrep I missed when searching NIST version of CVE database, which I tried doing before asking the quesion). Although it looks that the patch for it was still merged by Lasse Collin before giving any rights to the attacker group.

So technically the last pre-Jia-Tin commit in xz does not have any undisputed CVEs (personally, I agree with the disputed status of the DoS one)?

Baughn · 2024-04-03T16:49:07Z

So we could work with either that or xz-unscathed, then. I don't have any ability to decide which. But as I'm already attempting a rebuild with xz-unscathed, how about someone else tries v5.2.5? We could probably use a later commit, but that's the newest release that is Absolutely 100% Definitely not affected... and is also not an alpha.

correabuscar · 2024-04-03T17:05:08Z

in reply

to above

Another quick mitigation without mass rebuild is to pin Nixpkgs

For people that want to update xz without doing mass-rebuild while still getting the very latest nixpkgs, I would expect something like this to work (not tested):
  system.replaceRuntimeDependencies = [({
    original = pkgs.xz;
    replacement = pkgs.xz.overrideAttrs (rec {
      # put any version you like
      version = "5.4.6";
      src = fetchgit {
        url = "https://git.tukaani.org/xz.git";
        rev = "v${version}";
        hash = "sha256-uMUwR1I42R4hip5bJ1KOBKLZd9bb683z7xKeyB3M1Qg=";
      };
    });
  })];

I put the following in /etc/nixos/configuration.nix:

    #initially from: https://github.com/NixOS/nixpkgs/issues/300055#issuecomment-2034546410
    system.replaceRuntimeDependencies = [({
        original = pkgs.xz;
        replacement = pkgs.xz.overrideAttrs (finalAttrs: prevAttrs: {
        #(rec {
            version = "5.4.6";
            src = pkgs.fetchurl {
            url = with finalAttrs;
            # The original URL has been taken down.
            # "https://github.com/tukaani-project/xz/releases/download/v${version}/xz-${version}.tar.bz2";
            "mirror://sourceforge/lzmautils/xz-5.4.6.tar.bz2";
            sha256 = "sha256-kThRsnTo4dMXgeyUnxwj6NvPDs9uc6JDbcIXad0+b0k=";
            };

#Can't use this due to no Makefile or something like that:                                                
#            src = pkgs.fetchgit {
#            url = "https://git.tukaani.org/xz.git";
#            rev = "v${finalAttrs.version}";
#            hash = "sha256-uMUwR1I42R4hip5bJ1KOBKLZd9bb683z7xKeyB3M1Qg=";
#            };
            });
        })];

(note that I can use ${finalAttrs.version} in the url instead, and/or can use rec instead of finalAttrs: prevAttrs:, it won't change anything, I just tried it with hardcoded 5.4.6 last time to be sure)

It did something for 3 minutes after # nixos-rebuild switch the first time I tried it, but how do I know it worked?

$ nix-store --query --tree  /nix/var/nix/profiles/system |grep -- "-xz-5"
│   └───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0
│       └───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   │   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   ├───/nix/store/gc63f7dkfvmpd0cnalj3nwrk7i8xpbmq-xz-5.4.6-bin
│   │   │   └───/nix/store/ablizbhgzblclxdqkh6d26b14s8dqnk0-xz-5.4.6
│   │   │       └───/nix/store/ablizbhgzblclxdqkh6d26b14s8dqnk0-xz-5.4.6 [...]
│   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   │   └───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   │   │   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   ├───/nix/store/gc63f7dkfvmpd0cnalj3nwrk7i8xpbmq-xz-5.4.6-bin [...]
│   │       │   │   │   │   │   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │       │   │   │   │   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │       │   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   │   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   │   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │       ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   │   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   │   │   │   │   │   │   │   │   ├───/nix/store/p6iz6wa3lqwzf5nbihpv52zpp1ji9243-xz-5.6.0-bin
│   │   │   │   │   │   │   │   │   │   │   └───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   │   │   │   │   │   │   │   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   │   │   │   │   │   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   ├───/nix/store/5yv0177c7ip8h4591y71ac4cxaq3yx5q-xz-5.6.0-doc
│   │   │   │   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   ├───/nix/store/jx06mm16xjqaz90xndxa0f8r21p3bkj4-xz-5.6.0-man
│   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]
│   │       │   ├───/nix/store/zg5z7q9gmwrfpkbzxlcq4gvbv2lwa7r2-xz-5.6.0
│   │       │   │   └───/nix/store/zg5z7q9gmwrfpkbzxlcq4gvbv2lwa7r2-xz-5.6.0 [...]
│   │       │   │   │   ├───/nix/store/zg5z7q9gmwrfpkbzxlcq4gvbv2lwa7r2-xz-5.6.0 [...]
│   │       │   │   │   └───/nix/store/zg5z7q9gmwrfpkbzxlcq4gvbv2lwa7r2-xz-5.6.0 [...]
│   │       │   │   │   ├───/nix/store/s17lg0fy74ncncp62f9lz7ikzxmkp59x-xz-5.6.0-bin
│   │       │   │   │   │   └───/nix/store/zg5z7q9gmwrfpkbzxlcq4gvbv2lwa7r2-xz-5.6.0 [...]
│   │       │   │   ├───/nix/store/zg5z7q9gmwrfpkbzxlcq4gvbv2lwa7r2-xz-5.6.0 [...]
│   │       │   │   │   │   │   ├───/nix/store/zg5z7q9gmwrfpkbzxlcq4gvbv2lwa7r2-xz-5.6.0 [...]
│   │       │   │   ├───/nix/store/zg5z7q9gmwrfpkbzxlcq4gvbv2lwa7r2-xz-5.6.0 [...]
│   │       │   │   ├───/nix/store/zg5z7q9gmwrfpkbzxlcq4gvbv2lwa7r2-xz-5.6.0 [...]
│   │   ├───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0 [...]

[user@vbox1:~]$ nix why-depends /nix/var/nix/profiles/system /nix/store/ablizbhgzblclxdqkh6d26b14s8dqnk0-xz-5.4.6
/nix/store/r0hag18xw29j50ad583rdlxnww1nznnv-nixos-system-vbox1-24.05.git.b1ee0bf6e321
└───/nix/store/3gzm0idhr13acb9y478v61kfw9dn4izq-system-path
    └───/nix/store/gc63f7dkfvmpd0cnalj3nwrk7i8xpbmq-xz-5.4.6-bin
        └───/nix/store/ablizbhgzblclxdqkh6d26b14s8dqnk0-xz-5.4.6

[user@vbox1:~]$ nix why-depends /nix/var/nix/profiles/system /nix/store/zg5z7q9gmwrfpkbzxlcq4gvbv2lwa7r2-xz-5.6.0
/nix/store/r0hag18xw29j50ad583rdlxnww1nznnv-nixos-system-vbox1-24.05.git.b1ee0bf6e321
└───/nix/store/378ggrc57vcc9sm8yq50sjcidpp3h9yz-etc
    └───/nix/store/6rzqrphrav3x5fb5r2g6zvv5bgd3hpk2-etc-alsa-conf.d-49-pipewire-modules.conf
        └───/nix/store/nh420baz2jmflgnwl5x72ncjqzqa398q-pipewire-1.0.3
            └───/nix/store/0grf56m46f34q0fs5z0a7ramng46zbcy-ffmpeg-headless-6.1-lib
                └───/nix/store/zg5z7q9gmwrfpkbzxlcq4gvbv2lwa7r2-xz-5.6.0

[user@vbox1:~]$ nix why-depends /nix/var/nix/profiles/system /nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0
/nix/store/r0hag18xw29j50ad583rdlxnww1nznnv-nixos-system-vbox1-24.05.git.b1ee0bf6e321
└───/nix/store/9a25lb7iy59k40xzl44zj278d7dkfzmm-systemd-255.2
    └───/nix/store/y2w59ka6i69rka3s5wc66awqh1bgaxjg-xz-5.6.0

Thanks.

NixOS/nixpkgs#300055 https://nixpk.gs/pr-tracker.html?pr=300028 Signed-off-by: ahuston-0 <aliceghuston@gmail.com>

0xDubdub · 2024-04-03T18:49:33Z

@correabuscar xz 5.4.6 has landed in unstable, no need to build it manually.

aikooo7 · 2024-04-03T23:30:55Z

Since it is already in unstable shouldn't this be closed?

ShamrockLee · 2024-04-03T23:45:54Z

Since it is already in unstable shouldn't this be closed?

The discussions about how to handle upstream malicious commits before xz 5.6 is still ongoing.

Should this topic be considered in-scope or out-of-scope of this issue? If the former, we should keep it open.

ShamrockLee · 2024-04-03T23:48:28Z

BTW, the effectiveness of system.replaceRuntimeDependenciesas a mitigation toward supply-chain attack is also important IMO.

It deserves a new (separated) issue.

aikooo7 · 2024-04-04T01:35:01Z

BTW, the effectiveness of system.replaceRuntimeDependenciesas a mitigation toward supply-chain attack is also important IMO.

It deserves a new issue.

rn I am trying to override the xz version to 5.3.1 but I am failing :(, maybe I could get some help?

RossComputerGuy · 2024-04-04T01:37:02Z

BTW, the effectiveness of system.replaceRuntimeDependenciesas a mitigation toward supply-chain attack is also important IMO.
It deserves a new issue.

rn I am trying to override the xz version to 5.3.1 but I am failing :(, maybe I could get some help?

If you need help, Matrix and Discourse are a great place to ask (you can even log in with GitHub) 🦆.

aikooo7 · 2024-04-04T01:43:56Z

BTW, the effectiveness of system.replaceRuntimeDependenciesas a mitigation toward supply-chain attack is also important IMO.
It deserves a new issue.

rn I am trying to override the xz version to 5.3.1 but I am failing :(, maybe I could get some help?

If you need help, Matrix and Discourse are a great place to ask (you can even log in with GitHub) 🦆.

Sure, I am just wondering how hard it is to change the version of a package here, I searched so many time and can't do it xD, I will follow your suggestion. Thanks you.

aikooo7 · 2024-04-04T01:56:45Z

in reply

to above

I put the following in /etc/nixos/configuration.nix:

    #initially from: https://github.com/NixOS/nixpkgs/issues/300055#issuecomment-2034546410
    system.replaceRuntimeDependencies = [({
        original = pkgs.xz;
        replacement = pkgs.xz.overrideAttrs (finalAttrs: prevAttrs: {
        #(rec {
            version = "5.4.6";
            src = pkgs.fetchurl {
            url = with finalAttrs;
            # The original URL has been taken down.
            # "https://github.com/tukaani-project/xz/releases/download/v${version}/xz-${version}.tar.bz2";
            "mirror://sourceforge/lzmautils/xz-5.4.6.tar.bz2";
            sha256 = "sha256-kThRsnTo4dMXgeyUnxwj6NvPDs9uc6JDbcIXad0+b0k=";
            };

#Can't use this due to no Makefile or something like that:                                                
#            src = pkgs.fetchgit {
#            url = "https://git.tukaani.org/xz.git";
#            rev = "v${finalAttrs.version}";
#            hash = "sha256-uMUwR1I42R4hip5bJ1KOBKLZd9bb683z7xKeyB3M1Qg=";
#            };
            });
        })];

(note that I can use ${finalAttrs.version} in the url instead, and/or can use rec instead of finalAttrs: prevAttrs:, it won't change anything, I just tried it with hardcoded 5.4.6 last time to be sure)

It did something for 3 minutes after # nixos-rebuild switch the first time I tried it, but how do I know it worked?

Thanks.

Hey using your config with flake.nix I get:

error:
… while calling the 'head' builtin

     at /nix/store/wx38bcq0bi8xhia8yq21syxlkf65fk4j-source/lib/attrsets.nix:1541:11:

     1540|         || pred here (elemAt values 1) (head values) then
     1541|           head values
         |           ^
     1542|         else

   … while evaluating the attribute 'value'

     at /nix/store/wx38bcq0bi8xhia8yq21syxlkf65fk4j-source/lib/modules.nix:809:9:

      808|     in warnDeprecation opt //
      809|       { value = builtins.addErrorContext "while evaluating the option `${showOption loc}':" value;
         |         ^
      810|         inherit (res.defsFinal') highestPrio;

   (stack trace truncated; use '--show-trace' to show the full trace)

   error: 'builtins.storePath' is not allowed in pure evaluation mode

   at «none»:0: (source not available)

EDIT: Related to #199162 , fixed using --impure

HirschBerge · 2024-04-04T02:00:06Z

Does this really need to turn into a bug squashing session? I think this is muddying the water, especially since it's been mentioned that this should stay open for reference for those discussing how to handle supply chain issues moving forward.

As others have stated, there is discourse and such for this.

aikooo7 · 2024-04-04T02:07:32Z

reference

For me it should be also closed, I'm just using this issue because is open and my problem is partially fixed here

npulidomateo · 2024-04-04T06:05:03Z

Since it is already in unstable shouldn't this be closed?

No. The issue with the backdoor is not yet fixed or cleared. What made it into unstable is just a very temporary workaround, necessary because of the urgency of the issue.

vcunat · 2024-04-04T06:18:32Z

@npulidomateo: can you elaborate what's missing with the backdoor?

npulidomateo · 2024-04-04T06:40:22Z

Well, I'm no expert, but I'm not sure it has been yet proven that 5.4.6 is completely clean. Please correct me if I'm wrong.

vcunat · 2024-04-04T06:49:46Z

I'd put such related topics into other issues, cross-linking them here. It's also not distro-specific, so I'm not even sure that the best place for that is around NixOS.org

npulidomateo · 2024-04-04T08:05:56Z

Well @vcunat I guess you can also see it that way. I kind of feel that it's not wrong to aggregate here information about the backdoor issue in general.

Anyway thanks for making the fix / workaround.

7c6f434c · 2024-04-04T09:35:42Z

I also feel that «how far to roll back/which fork to use» is a priori exactly the topic here…

correabuscar · 2024-04-04T10:02:18Z

re comment
@aikooo7 It seems you have found a solution for flakes (I wasn't using the flakes way so I've no idea how that works at the moment)

Regarding system.replaceRuntimeDependencies, I've tried it for tests (outside of xz) and it does seem to work for my isolated test case whereby, with some help, I made a rust dynamic lib (.so) which I then use in a rust bin¹, then used replaceRuntimeDependencies to replace the lib² that that bin was using without recompiling the bin during a # nixos-rebuild switch.

disclaimer

Note that I'm very newbie at nix/nixos, I didn't even read the manual or nixpills yet and I'm only using nixos in a VM, so some things may be (obviously) wrongly done in there, use your common sense :) (eg. use 'pname' instead of 'name')

the bin and lib are derivations in an overlay like: https://github.com/correabuscar/etcnixos/commit/8d1643504cec9c51832004d96d566b7a1c57ce3e ↩
https://github.com/correabuscar/etcnixos/commit/bee1dd58bb31f8c69d1c336670dc5a691e48aed1 ↩

LeSuisse · 2024-04-04T17:14:44Z

I'm going to close this as the revert to 5.4.6 is now available in nixos-unstable and as such CVE-2024-3094 is mitigated (note that anyway the nixpkgs xz did not embed the backdoor payload).

AFAIK no concrete evidence regarding the compromise of the 5.4.6 release have been exposed despite various communities taking a closer at the source code and release tarballs since Friday. Reverting to older releases is not as easy as it may sound due to some ABI changes (and also performance regressions).

Progress of follow up actions from this incident can be done in dedicated pull-requests and/or issues. It will make things easier to track for everyone and, of course, we can re-open this if new information comes to light.

- Removes awscli overlay - Downgrade `xz` to 5.4.6 [CVE-2024-3094](NixOS/nixpkgs#300055)

The fix has been propagated to nixpkgs-unstable. See NixOS/nixpkgs#300055 (comment)

NixOS/nixpkgs#300055 https://nixpk.gs/pr-tracker.html?pr=300028 Signed-off-by: ahuston-0 <aliceghuston@gmail.com>

dfoxfranke added 0.kind: bug 1.severity: security labels Mar 29, 2024

dfoxfranke mentioned this issue Mar 29, 2024

xz: release tarballs contain a backdoor (CVE-2024-3094) #300057

Closed

pokon548 added a commit to pokon548/OysterOS that referenced this issue Mar 30, 2024

nix: SECURITY: Rollback xz to 5.2.9 in respond of malicious backdoor …

f196903

…suspected. See NixOS/nixpkgs#300055

roberth pinned this issue Mar 30, 2024

bal-sm added a commit to bal-sm/bal_cfg that referenced this issue Mar 30, 2024

Used staging-next heula

f2b634f

'cause wat the fuck anying eta: - <https://www.reddit.com/r/ProgrammerHumor/comments/1bqwlg6/dontactsusyoujustcompromisedssh/> - <NixOS/nixpkgs#300055> - lanjutin sayanggg

kachick mentioned this issue Mar 30, 2024

Track xz 👿 kachick/dotfiles#530

Closed

TanvirOnGH mentioned this issue Mar 30, 2024

Backdoor in upstream xz/liblzma TanvirOnGH/nix-config#4

Open

bal-sm added a commit to bal-sm/bal_cfg that referenced this issue Mar 30, 2024

Used staging-next heula

359e93a

'cause wat the fuck anying eta: - <https://www.reddit.com/r/ProgrammerHumor/comments/1bqwlg6/dontactsusyoujustcompromisedssh/> - <NixOS/nixpkgs#300055> - lanjutin sayanggg

xav-ie added a commit to xav-ie/dots that referenced this issue Apr 3, 2024

hotfix(remove malware): NixOS/nixpkgs#300055

cef9ead

ahuston-0 added a commit to RAD-Development/nix-dotfiles that referenced this issue Apr 3, 2024

switch to nixos-unstable-small, which already finished the xz revert

784da65

NixOS/nixpkgs#300055 https://nixpk.gs/pr-tracker.html?pr=300028 Signed-off-by: ahuston-0 <aliceghuston@gmail.com>

aviallon mentioned this issue Apr 4, 2024

Use zstd for linux kernel modules #301536

Closed

LeSuisse closed this as completed Apr 4, 2024

LeSuisse changed the title ~~xz-5.6.x is trojaned~~ xz-5.6.x is trojaned (CVE-2024-3094) Apr 4, 2024

LeSuisse unpinned this issue Apr 4, 2024

archer-65 added a commit to archer-65/nix-dotfiles that referenced this issue Apr 4, 2024

flake: bump

051fa17

- Removes awscli overlay - Downgrade `xz` to 5.4.6 [CVE-2024-3094](NixOS/nixpkgs#300055)

brckd added a commit to brckd/nixdots that referenced this issue Apr 8, 2024

revert: 3a70da9

3048227

The fix has been propagated to nixpkgs-unstable. See NixOS/nixpkgs#300055 (comment)

ahuston-0 added a commit to ahuston-0/nix-dotfiles-hydra that referenced this issue Apr 18, 2024

switch to nixos-unstable-small, which already finished the xz revert

35a3769

NixOS/nixpkgs#300055 https://nixpk.gs/pr-tracker.html?pr=300028 Signed-off-by: ahuston-0 <aliceghuston@gmail.com>

xz-5.6.x is trojaned (CVE-2024-3094) #300055

xz-5.6.x is trojaned (CVE-2024-3094) #300055

Comments

dfoxfranke commented Mar 29, 2024

dfoxfranke commented Mar 29, 2024

jaen commented Mar 29, 2024

Ulexus commented Mar 29, 2024

RossComputerGuy commented Mar 29, 2024

trofi commented Mar 29, 2024

Aleksanaa commented Mar 29, 2024

NightH4nter commented Mar 29, 2024 • edited

Aleksanaa commented Mar 29, 2024

ChanceHarrison commented Mar 29, 2024 • edited

Lymia commented Mar 29, 2024

panchoh commented Mar 29, 2024

Aleksanaa commented Mar 29, 2024 • edited

LeSuisse commented Mar 30, 2024

viraptor commented Mar 30, 2024 • edited

NightH4nter commented Mar 30, 2024 • edited

jwillikers commented Mar 30, 2024 • edited

dfoxfranke commented Mar 30, 2024

chushuai commented Mar 30, 2024 • edited

Aleksanaa commented Mar 30, 2024

Atry commented Mar 30, 2024

panchoh commented Mar 30, 2024

7c6f434c commented Apr 3, 2024

Baughn commented Apr 3, 2024

correabuscar commented Apr 3, 2024

0xDubdub commented Apr 3, 2024 • edited

aikooo7 commented Apr 3, 2024

ShamrockLee commented Apr 3, 2024

ShamrockLee commented Apr 3, 2024 • edited

aikooo7 commented Apr 4, 2024

RossComputerGuy commented Apr 4, 2024

aikooo7 commented Apr 4, 2024

aikooo7 commented Apr 4, 2024 • edited

HirschBerge commented Apr 4, 2024

aikooo7 commented Apr 4, 2024

npulidomateo commented Apr 4, 2024

vcunat commented Apr 4, 2024

npulidomateo commented Apr 4, 2024

vcunat commented Apr 4, 2024

npulidomateo commented Apr 4, 2024

7c6f434c commented Apr 4, 2024

correabuscar commented Apr 4, 2024

Footnotes

LeSuisse commented Apr 4, 2024

NightH4nter commented Mar 29, 2024 •

edited

ChanceHarrison commented Mar 29, 2024 •

edited

Aleksanaa commented Mar 29, 2024 •

edited

viraptor commented Mar 30, 2024 •

edited

NightH4nter commented Mar 30, 2024 •

edited

jwillikers commented Mar 30, 2024 •

edited

chushuai commented Mar 30, 2024 •

edited

0xDubdub commented Apr 3, 2024 •

edited

ShamrockLee commented Apr 3, 2024 •

edited

aikooo7 commented Apr 4, 2024 •

edited