Adam Kaminski thimslugga

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Update: I've disabled comments as of 2025-01-26 to avoid everyone having notifications for something a year on if someone wants to suggest a correction. Folks are free to email to suggest corrections still, of course.

Background

Manually fixing bit flips in BTRFS

Somehow my BTRFS file system became corrupted by what appears to be a single bit flip in a metadata field. Rather than copying all the data and reformatting the file system, which would have required another disk at least as large as the original, I decided to try to fix this manually, which appears to have worked. I've documented the procedure I've used here, in case I need it again or someone else runs into a similar issue and finds it useful.

The first thing you should do is run btrfs check. For me this produced the following output:

Opening filesystem to check...
Checking filesystem on /dev/nvme0n1p1
UUID: ec7afe1c-8478-450a-82fc-d17b32d8ca3d

Micromamba installation guide:

This gist is a summary on how to do it on Linux. If you're in another platform, see:
https://mamba.readthedocs.io/en/latest/micromamba-installation.html#:~:text=1.4.6-,Manual%20installation,-%C2%B6

Which Linux distro are you using?

For this, you can run: uname -m

Depending on the output, follow the command from the installation guide:

# Linux Intel (x86_64):

	#!/bin/bash

	#SBATCH --cpus-per-task=32
	#SBATCH --mem=32000
	#SBATCH --partition=short
	#SBATCH --output=env-manage.log
	#SBATCH --mail-type=END,FAIL
	#SBATCH --mail-user=

	set -e

	#!/usr/bin/env python

	import multiprocessing
	import random
	import time


	class Logger:
	def __init__(self, num_lines, last_output_per_process, terminal_lock):
	self.num_lines = num_lines

	// This example demonstrates creating mount namespace and using pivot_root()
	// It doesn't create a user namespace, so to run it we need sudo

	#define _GNU_SOURCE
	#include <stdio.h>
	#include <stdlib.h>
	#include <sched.h>
	#include <limits.h>
	#include <errno.h>
	#include <unistd.h>

	#!/bin/sh
	set -e

	TO=/x
	OLD_INIT=$(readlink /proc/1/exe)
	cd "$TO"

	if [ ! -e fakeinit ]; then
	./busybox echo "Please compile fakeinit.c first"
	exit 1

	blueprint:
	name: Appliance Notifications & Actions
	description: >
	# 📳 Appliance Notifications & Actions

	Version: 2.9


	🤔 Watts your appliance up to, you're always in the know from start to finish!🛎️🔌💸

	Function Convert-Image
	{
	Param (
	[Parameter(Mandatory = $true)]
	[string]$Name,

	[Parameter(Mandatory = $true)]
	[string]$Tag,

	[Parameter(Mandatory = $false)]

	#!/bin/bash

	sudo zypper refresh

	# setup developer tools first if you dont have them already
	sudo zypper install gcc zlib-devel bzip2 libbz2-devel libffi-devel libopenssl-devel readline-devel sqlite3 sqlite3-devel xz xz-devel

	# Download and install OpenSSL
	wget https://www.openssl.org/source/openssl-1.1.1l.tar.gz
	tar xvf openssl-1.1.1l.tar.gz