Looks like we have a new #xz vulnerability (backdoor):

Red Hat cites CVE-2024-3094 for this XZ security vulnerability due to malicious code making it into the codebase. I haven't seen CVE-2024-3094 made public yet but the Red Hat security alert sums it up as…

From this mailing list thread:

[quote]One portion of the backdoor is solely in the distributed tarballs. For easier reference, here's a link to debian's import of the tarball, but it is also present in the tarballs for 5.6.0 and 5.6.1:

salsa.debian.org/debian/xz-uti…

That line is *not* in the upstream source of build-to-host, nor is build-to-host used by xz in git. However, it is present in the tarballs released upstream, except for the "source code" links, which I think github generates directly from the repository contents:

• github.com/tukaani-project/xz/…
• github.com/tukaani-project/xz/…

This injects an obfuscated script to be executed at the end of configure. This script is fairly obfuscated and data from "test" .xz files in the repository.

This script is executed and, if some preconditions match, modifies $builddir/src/liblzma/Makefile to contain

which ends up as

Leaving out the "| bash" that produces

After de-obfuscation this leads to the attached injected.txt.

The files containing the bulk of the exploit are in an obfuscated form in

• tests/files/bad-3-corrupt_lzma2.xz
• tests/files/good-large_compressed.lzma

committed upstream. They were initially added in github.com/tukaani-project/xz/…

Note that the files were not even used for any "tests" in 5.6.0.

Subsequently the injected code (more about that below) caused valgrind errors and crashes in some configurations, due the stack layout differing from what the backdoor was expecting. These issues were attempted to be worked around in 5.6.1:

• github.com/tukaani-project/xz/…
• github.com/tukaani-project/xz/…
• github.com/tukaani-project/xz/…

For which the exploit code was then adjusted:

github.com/tukaani-project/xz/…

Given the activity over several weeks, the committer is either directly involved or there was some quite severe compromise of their system. Unfortunately the latter looks like the less likely explanation, given they communicated on various lists about the "fixes" mentioned above.

Florian Weimer first extracted the injected code in isolation, also attached, liblzma_la-crc64-fast.o, I had only looked at the whole binary. Thanks!

#Linux

He's really not capable of holding office.

People complain about how long rail transit projects take to build, but highway projects usual take even longer!

#CarBrain #CarBrained #CarBrains

#LibreOffice has changed its numbering system to a YY.M format instead. The first of the new system is LibreOffice 24.2. The last of the old system is 7.6.4

• Announcement

“When [scientists] look at what’s contributing to this, the use of phones and digital technology is a significant factor.”

Cris Rowan, a B.C.-based occupational therapist, added that phone use is impacting children's brain development and impacting their focus in class.

“Research is showing that grades are directly related to the number of times you open a text.... Even having that phone on the desk is hugely affecting kids.”

Both experts say cellphones in class are also likely contributing to an ongoing decrease in kid and teen mental health.

Experts also say that cellphones in class have a negative impact by increasing opportunities for cyberbullying.

#Canada #CBC #cellphone #smartphone #news

#security #bleeping computer #bleepingcomputer #computers #technology #news #education #updates #tech
generated by pod_feeder_v2

@SebinNyshkim I feel like this is unfortunately the logical continuation of things like:

• Automation in general, in both robotic and software forms
• Things being turned into unmaintainable/unrepairable black boxes
• Automatic transmissions in cars

The people producing and pushing this stuff want us to become slaves to them rather than learning how to do things ourselves. It's definitely "working," too, because much of the population is too scared to work on their own things, and is even scared of "having to use" hand/power tools to do anything.

What are some things you hate doing that everyone else does with seemingly few gripes?

#AskMastodon

Another new #scam to watch out for:

Ellen Thompson says she was encouraged by the large number of responses to an ad she posted on AutoTrader to sell her son's 2011 Honda CR-Z.

"The first day I was inundated with interested people and I thought 'Oh, this is crazy,'" says Thompson. "I couldn't even keep up to the interest."

Thompson had already paid for a vehicle history report for the pending sale, but she estimates nine out of every 10 text messages she received from potential buyers led to the same request for a vehicle history report from a different company.

#Scammers #news #CBC