smx-smx

XZ Backdoor symbol deobfuscation. Updated as i make progress

q3k

0810 b' from '
0678 b' ssh2'
00d8 b'%.48s:%.48s():%d (pid=%ld)\x00'
0708 b'%s'
0108 b'/usr/sbin/sshd\x00'
0870 b'Accepted password for '
01a0 b'Accepted publickey for '
0c40 b'BN_bin2bn\x00'
06d0 b'BN_bn2bin\x00'
0958 b'BN_dup\x00'

ecki

After 2024-04-02 I am only adding important new discoveries (I come accross). There is just too much Blog and Video entries to keep track of.

Initial disclosure:

• https://www.openwall.com/lists/oss-security/2024/03/29/4
• Aka https://lwn.net/ml/oss-security/20240329155126.kjjfduxw2yrlxgzm@awork3.anarazel.de/

CVE and Alerts

• https://github.com/advisories/GHSA-rxwq-x6h5-x525
• https://nvd.nist.gov/vuln/detail/CVE-2024-3094
• https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

milos7250

#!/bin/bash

#SBATCH --cpus-per-task=32
#SBATCH --mem=32000
#SBATCH --partition=short
#SBATCH --output=env-manage.log
#SBATCH --mail-type=END,FAIL
#SBATCH --mail-user=

set -e

tekknolagi

#!/usr/bin/env python

import multiprocessing
import random
import time


class Logger:
    def __init__(self, num_lines, last_output_per_process, terminal_lock):
        self.num_lines = num_lines

MaartenBaert

Manually fixing bit flips in BTRFS

Somehow my BTRFS file system became corrupted by what appears to be a single bit flip in a metadata field. Rather than copying all the data and reformatting the file system, which would have required another disk at least as large as the original, I decided to try to fix this manually, which appears to have worked. I've documented the procedure I've used here, in case I need it again or someone else runs into a similar issue and finds it useful.

The first thing you should do is run btrfs check. For me this produced the following output:

Opening filesystem to check...
Checking filesystem on /dev/nvme0n1p1
UUID: ec7afe1c-8478-450a-82fc-d17b32d8ca3d

ig0rmin

// This example demonstrates creating mount namespace and using pivot_root()
// It doesn't create a user namespace, so to run it we need sudo

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <sched.h>
#include <limits.h>
#include <errno.h>
#include <unistd.h>

LloydAsp

#!/bin/sh
set -e

TO=/x
OLD_INIT=$(readlink /proc/1/exe)
cd "$TO"

if [ ! -e fakeinit ]; then
    ./busybox echo "Please compile fakeinit.c first"
    exit 1

midoriiro

Function Convert-Image
{
	Param (
		[Parameter(Mandatory = $true)]
		[string]$Name,

		[Parameter(Mandatory = $true)]
		[string]$Tag,

		[Parameter(Mandatory = $false)]