Lingfeng Zhang ccat3z

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

Docker on Android 🐋📱

Edit 🎉

All packages, except for Tini have been added to termux-root. To install them, simply pkg install root-repo && pkg install docker. This will install the whole docker suite, left only Tini to be compiled manually.

Summary

ipvtap over wifi for libvirt

ipvtap is similar to macvtap, but works over wifi too, since it uses the same mac address as the wifi interface.

libvirt doesn't support ipvtap, so we have to configure everything manually. Important data we need before we start:

the name of the wifi interface, wlan0 in my case (it's already connected - use NM or networkd+iwd).
the mac address of the wifi interface (it must be the same in the guest too)

On the host:

Android Volume Steps

Warning

This is a rather old guide and may or may not work with modern versions of Android.

Connect through ADB

Boot into TWRP
Connect device to computer
Terminal: List devices with adb devices

Reddit post (Archived)

Table of Content

What to expect?
- Some TLDR about the idea behind
Prerequisites
- Hardware
- System & Software
Update: Attention for MUXless laptop

Run commands on remote Docker host

This is how to connect to another host with your docker client, without modifying your local Docker installation or when you don't have a local Docker installation.

Enable Docker Remote API

First be sure to enable the Docker Remote API on the remote host.

This can easily be done with a container.
For HTTP connection use jarkt/docker-remote-api.

	const path = require('path')
	const fs = require('fs')
	const { execSync } = require('child_process')

	let file = path.join(process.cwd(), 'core.wxvpkg')
	if (fs.existsSync(file)) {
	execSync(`rmtrash ${file}`)
	}

	let fd = fs.openSync(file, 'w')

	#!/bin/bash

	# Convenient when you're using lots of in-browser terminals.

	set -eu

	MAXLEN=74994
	TARGET=$1

	if [ -f $TARGET ]; then

	#!/bin/bash

	set -euo pipefail

	openssl req -new -text -passout pass:abcd -subj /CN=localhost -out server.req -keyout privkey.pem
	openssl rsa -in privkey.pem -passin pass:abcd -out server.key
	openssl req -x509 -in server.req -text -key server.key -out server.crt
	chmod 600 server.key
	test $(uname -s) = Linux && chown 70 server.key
	docker run -d --name postgres -e POSTGRES_HOST_AUTH_METHOD=trust -v "$(pwd)/server.crt:/var/lib/postgresql/server.crt:ro" -v "$(pwd)/server.key:/var/lib/postgresql/server.key:ro" postgres:12-alpine -c ssl=on -c ssl_cert_file=/var/lib/postgresql/server.crt -c ssl_key_file=/var/lib/postgresql/server.key

	#define _GNU_SOURCE
	#include <stdio.h>
	#include <unistd.h>
	#include <string.h>
	#include <assert.h>
	#include <dlfcn.h>

	// compile: gcc polybridge_fix.c -o polybridge_fix.so -ldl -shared -fPIC
	// use: set launch command in steam to
	// LD_PRELOAD=/path/to/polybridge_fix.so %command%