Sebastian Pipping hartwork

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

Container security notes

Internet references

Kernel and architecture

namespaces - overview of Linux namespaces http://man7.org/linux/man-pages/man7/namespaces.7.html
mount_namespaces - overview of Linux mount namespaces

After reading Why I'm Frequently Absent from Open Source by James Long and listening the corresponding The Changelog episode, I dwelt on the idea and believe that open source maintainers...

... should never be ashamed if they don't have time for a project.
... should be honest with themselves and open with their users so that everybody can be on the same page
... are people and they have at one time or another responsibilities or hardships that they need to attend to which reasonably take them away from a project
... may also reasonbly decide that they don't like the direction of a project or that they would like to explore other things and may leave a project permanently.

Along this line of thinking I've created a set of descriptions for different levels at which a project might be maintained. A maintainer can use these to announce to their users the current ability that they have to dedicate to a pr

	Maybe this helps someone when they Google this.

	[ 48%] Building CXX object runtime_src/core/tools/xbtracer/CMakeFiles/xrt_trace.dir/src/wrapper/tracer.cpp.o
	/usr/bin/ld: libxbtracer_protobuf.a(func.pb.cc.o): undefined reference to symbol '_ZN4absl12lts_2025081412log_internal21CheckOpMessageBuilder7ForVar2Ev'
	/usr/bin/ld: /usr/lib/libabsl_log_internal_check_op.so.2508.0.0: error adding symbols: DSO missing from command line
	collect2: error: ld returned 1 exit status

	XRT master  ❯ git diff
	diff --git a/src/runtime_src/core/tools/xbtracer/CMakeLists.txt b/src/runtime_src/core/tools/xbtracer/CMakeLists.txt
	index 2276159fb..02631afe9 100644

	'''Licensed under the MIT License :)'''

	import pefile
	import pprint
	pe = pefile.PE('example.exe')


	string_version_info = {}

	for fileinfo in pe.FileInfo[0]:

	# taken from http://www.piware.de/2011/01/creating-an-https-server-in-python/
	# generate server.xml with the following command:
	# openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes
	# run as follows:
	# python simple-https-server.py
	# then in your browser, visit:
	# https://localhost:4443

	import BaseHTTPServer, SimpleHTTPServer
	import ssl