{"id":116209,"date":"2024-05-30T15:40:12","date_gmt":"2024-05-30T13:40:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-xz-opublikoval-rezultat-audita-kommitov-i-pervoe-obnovlenie-posle-vyyavleniya-bekdora"},"modified":"2024-05-30T15:40:12","modified_gmt":"2024-05-30T13:40:12","slug":"proekt-xz-opublikoval-rezultat-audita-kommitov-i-pervoe-obnovlenie-posle-vyyavleniya-bekdora","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/proekt-xz-opublikoval-rezultat-audita-kommitov-i-pervoe-obnovlenie-posle-vyyavleniya-bekdora","title":{"rendered":"The XZ project has published the results of a commit audit and the first update following the discovery of a backdoor.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Lasse Collin, the previous maintainer of the xz project, transferred the responsibilities to the new maintainer Jia Tan in 2022, whose actions led to the introduction of a backdoor. He released corrective versions of the XZ Utils package 5.2.13, 5.4.7, and 5.6.2, which remove the backdoor components and other suspicious changes introduced during the previous maintainer's malicious activities. <\/p>\n
Additionally, a report has been published reviewing the Git repository and changes made since December 2022 during Jia Tan's tenure as maintainer. The changes are broken down at the individual commit level. The commits in the repository were not signed with a digital signature, but no evidence of forgery by the committers was found. A total of 8 malicious commits have been removed from the repository. <\/p>\n
The CRC CLMUL code, which causes false positives during checks in MSAN (Memory Sanitizer) and problems with OSS Fuzz, has not yet been removed from the codebase. It is planned to be reworked in the future, but for now, it has been decided not to touch it to avoid regressions in old branches. No suspicious changes were found in old commits added before the backdoor-related changes. po localization files, metadata in tar files, and archives with releases and translations were also reviewed separately. <\/p>\n
Among the changes, the inclusion of accumulated bug fixes and the removal of support for the IFUNC mechanism provided in Glibc for indirect function calls, which was exploited for function interception in the backdoor, are noted. It has been observed that using IFUNC complicates the code, and the performance gain from it is not significant. As a precaution, the XZ logo, PDF versions of man pages, and two tests for x86 and SPARC architectures, which processed object files as input, were also removed from the package with the source code. <\/p>\n
Among the new features, the xzdec decoder now supports the ABI version 4 of the Landlock application isolation mechanism. The Autotools build scripts have been updated with the option «—enable-doxygen», and in the CMake script, the ENABLE_DOXYGEN parameter has been added for generating and installing documentation for the liblzma API using Doxygen. The already generated documentation has been removed from the package. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"