Skip to content

Instantly share code, notes, and snippets.

@denix0
denix0 / xz-backdoor.md
Created April 1, 2024 19:40 — forked from thesamesam/xz-backdoor.md
xz-utils backdoor situation (CVE-2024-3094)

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is still a new situation. There is a lot we don't know. We don't know if there are more possible exploit paths. We only know about this one path. Please update your systems regardless.

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

alias: Xfinity Sets House Mode
description: ""
trigger:
- platform: state
entity_id:
- sensor.xfinity_status
to: home
id: home
- platform: state
entity_id:
sensor:
- platform: imap_email_content
server: imap.gmail.com
name: xfinity_status
port: 993
username: !secret xfinity_email
password: !secret xfinity_password
senders:
- do-not-reply@xfinityhomesecurity.com
value_template: >-

Keybase proof

I hereby claim:

  • I am denix0 on github.
  • I am denix (https://keybase.io/denix) on keybase.
  • I have a public key whose fingerprint is 40B2 64D4 7594 5731 8F47 4DC5 432A 40BC 1CF0 81EC

To claim this, I am signing this object:

$ make CROSS_COMPILE=arm-linux-gnueabihf- am335x_evm_defconfig
HOSTCC scripts/basic/fixdep
HOSTCC scripts/kconfig/conf.o
HOSTCC scripts/kconfig/zconf.tab.o
HOSTLD scripts/kconfig/conf
#
# configuration written to .config
#
#
# configuration written to spl/.config