thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

MaskRay

If you link a program with a compiler driver (clang/gcc) in a standard way (not -nostdlib), the following components are usually on the linker command line.

• crt1.o (glibc/musl): -no-pie/-pie/-static-pie
  • crt1.o: -no-pie
  • Scrt1.o: -pie, -shared
  • rcrt1.o: -static-pie
  • gcrt1.o:
• crti.o (glibc/musl)
• crtbegin.o

• crtbegin.o: -no-pie