Linux
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
Not everything is known yet, so you won't find a comprehensive summary. The latest news I've seen: https://www.openwall.com/lists/oss-security/2024/03/30/36
I'm watching some folks reverse engineer the xz backdoor, sharing some preliminary analysis with permission. The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system(). It's RCE, not auth bypass, and gated/unreplayable.
All the technical details that are widely known (and some that aren't yet) seem to be in that thread, including the original report from Andres Freund. For rumours about who might be behind it and high-level speculation about what it all means, you'd have to look elsewhere.
thx :)
https://boehs.org/node/everything-i-know-about-the-xz-backdoor gives a good overview with links to further reads.
awesome, thanks!
Sam Jones's FAQ is by far the best single source, links to other solid sources for more in-depth technical details and also lightly debunks a few things.
The main thing sources online disagree on are which distros are affected. That's because it's not a simple yes/no and some distros are taking a nuanced approach in their public communication, while others have chosen the sledgehammer in an attempt to get people to upgrade their systems but keep/kept the nuance in the back room where the audience understood not everything was known yet. Some distros are underselling how vulnerable they were, others are overselling it.
Best coverage I've seen so far has been on Ars Technica.
I read a few articles. I think Andres Freund's announcement gave me the best context for the exploit itself. https://www.openwall.com/lists/oss-security/2024/03/29/4
The most helpful source I saw on which systems are affected was this Lemmy post, https://beehaw.org/post/12813772
It's still ongoing and still being reverse engineered, so I would expect the good writeups to come in a couple days.