thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

cjihrig

'use strict';
const assert = require('node:assert');
const fs = require('node:fs/promises');
const DATA_HOME_URL = 'https://storage.googleapis.com/access-logs-summaries-nodejs/index.html';
const DATA_FILE_PATH = 'data.json';
const DATA_CSV_PATH = 'data.csv';
const DATA_CSV_SEVEN_DAY_PATH = 'data-seven-day-avg.csv';
const LINES = ['14', '16', '18', '19', '20'];

async function main() {

mcollina

import { setTimeout } from 'timers/promises'
import { strictEqual } from 'assert'

let called = 0

async function * merge (a, b) {
  try {
    yield *a
    yield *b
  } finally {

jasnell

import * as foo from 'http://localhost:3001/foo.ts'

levelsio

<?
	# MIT license, do whatever you want with it
	#
	# This is my invoice.php page which I use to make invoices that customers want,
	# with their address on it and which are easily printable. I love Stripe but
	# their invoices and receipts were too wild for my customers on Remote OK
	#
	
	require_once(__DIR__.'/../vendor/autoload.php');

mcollina

#!/bin/bash

sysctl net.core.rmem_default=268435456
sysctl net.core.wmem_default=268435456
sysctl net.core.rmem_max=268435456
sysctl net.core.wmem_max=268435456
sysctl net.core.netdev_max_backlog=100000
sysctl "net.ipv4.tcp_rmem=4096 16384 134217728"
sysctl "net.ipv4.tcp_wmem=4096 16384 134217728"
sysctl "net.ipv4.tcp_mem=786432 1048576 268435456"

trevnorris

Notes:

• Text in [[ ]] are the internal libuv function call.
• Text in {{ }} are the Node functions that are affected.
• Text in ( ) are notes about what is happening.
• While the Windows event loop has minor variations, I don't believe any of those affect Node.

---

On process.nextTick():

totherik

Per https://code.google.com/p/v8/codesearch#v8/trunk/src/runtime.cc


%CreateSymbol
%CreatePrivateSymbol
%CreateGlobalPrivateSymbol
%NewSymbolWrapper
%SymbolDescription
%SymbolRegistry
%SymbolIsPrivate

jasonkuhrt

'use strict';

var tcp = require('net');



var s1 = tcp.createServer().listen(9000);
var s2 = tcp.createServer().listen(9001);
var s3 = tcp.createServer().listen(9002);

trevnorris

build

Clone and build Node for analysis:

$ git clone https://github.com/joyent/node.git
$ cd node
$ export GYP_DEFINES="v8_enable_disassembler=1"
$ ./configure
$ make -j4