473
Arch with XZ (lemmy.world)
submitted 7 months ago by qwioeue@lemmy.world to c/linuxmemes@lemmy.world
93 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[-] possiblylinux127@lemmy.zip 5 points 7 months ago

It is not entirely clear either this exploit can affect other parts of the system. This is one those things you need to take extremely seriously

[-] SpaceCadet@feddit.nl 2 points 7 months ago

In the case of Arch the backdoor also wasn't inserted into liblzma at all, because at build time there was a check to see if it's being built on a deb or rpm based system, and only inserts it in those two cases.

See https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 for an analysis of the situation.

So even if Arch built their xz binaries off the backdoored tarball, it was never actually vulnerable.

[-] possiblylinux127@lemmy.zip 1 points 7 months ago

I just know there is a lot of uncertainty. Maybe a complete wipe is a over reaction but it is better to be safe

this post was submitted on 30 Mar 2024
473 points (84.3% liked)

linuxmemes

21281 readers
619 users here now

Hint: :q!

Sister communities:

Community rules (click to expand)

1. Follow the site-wide rules

2. Be civil
  • Understand the difference between a joke and an insult.
  • Do not harrass or attack members of the community for any reason.
  • Leave remarks of "peasantry" to the PCMR community. If you dislike an OS/service/application, attack the thing you dislike, not the individuals who use it. Some people may not have a choice.
  • Bigotry will not be tolerated.
  • These rules are somewhat loosened when the subject is a public figure. Still, do not attack their person or incite harrassment.
    • 3. Post Linux-related content
  • Including Unix and BSD.
  • Non-Linux content is acceptable as long as it makes a reference to Linux. For example, the poorly made mockery of sudo in Windows.
  • No porn. Even if you watch it on a Linux machine.
    • 4. No recent reposts
  • Everybody uses Arch btw, can't quit Vim, and wants to interject for a moment. You can stop now.
    •  

    Please report posts and comments that break these rules!

    Important: never execute code or follow advice that you don't understand or can't verify, especially here. The word of the day is credibility. This is a meme community -- even the most helpful comments might just be shitposts that can damage your system. Be aware, be smart, don't fork-bomb your computer.

    founded 1 year ago
    MODERATORS
    poopsmith@lemmy.world
    zephyr@lemmy.world
    rtxn@lemmy.world