sfx2000
Part of the Furniture
This had some traction over in AsusWRT-Addon's thread... I would post there, but the thread was closed.
www.snbforums.com
A couple of good write ups and analysis for this CVE are below
and..
The boehs.org post has a lot of good back story, esp on how someone was able to gain trust thru a number of means, well before inserting the backdoor.
The second post is far more technical, but also shows the dependencies - e.g. has to be a systemd enabled build, with glibc, and x86-64, along with OpenSSH (sshd)
Where my interest was - OpenWRT, looks like formal releases were not impacted, but SNAPSHOT buillds off MASTER did include the impacted version of xz-utils, this was rolled back on Friday for MASTER...
AsusWRT isn't impacted, and I believe that Entware is safe as well - here's OpenWRT's official response to the CVE
forum.openwrt.org
Entware - Backdoor in linux XZ utils on Linux distros.
https://www.phoronix.com/news/XZ-CVE-2024-3094 Whomp whomp 😑 *Doesn't appear to be incorporated into Asuswrt-Merlin. 5.4.6-1 xz is a entware however “Some malicious code was added to XZ 5.6.0/5.6.1 that could allow unauthorized remote system access.” Earlier versions should be safe however xz...
www.snbforums.com
A couple of good write ups and analysis for this CVE are below
Everything I know about the XZ backdoor
Please note: This is being updated in real-time. The intent is to make sense of lots of simultaneous discoveries
boehs.org
and..
The boehs.org post has a lot of good back story, esp on how someone was able to gain trust thru a number of means, well before inserting the backdoor.
The second post is far more technical, but also shows the dependencies - e.g. has to be a systemd enabled build, with glibc, and x86-64, along with OpenSSH (sshd)
Where my interest was - OpenWRT, looks like formal releases were not impacted, but SNAPSHOT buillds off MASTER did include the impacted version of xz-utils, this was rolled back on Friday for MASTER...
Code:
commit d4b6b76443207103d3a7c0eae5c0085317fb584f
Author: Petr Štetiar <ynezz@true.cz>
Date: Fri Mar 29 16:59:01 2024 +0000
Revert "tools/xz: update to 5.6.1" (CVE-2024-3094)
This reverts commit 714c91d1a63f29650abaa9cf69ffa47cf2c70297 as probably
the upstream xz repository and the xz tarballs have been backdoored.
References: https://www.openwall.com/lists/oss-security/2024/03/29/4.
Signed-off-by: Petr Štetiar <ynezz@true.cz>AsusWRT isn't impacted, and I believe that Entware is safe as well - here's OpenWRT's official response to the CVE
Project statement about xz 5.6.1 (CVE-2024-3094)
Hi, tl;dr OpenWrt seems to be not affected by the CVE-2024-3094 As you may be aware, malicious code was identified in the xz upstream tarballs starting from version 5.6.0. The development snapshots of OpenWrt were utilizing this compromised library version. Fortunately, the snapshots builds...
forum.openwrt.org
Last edited:
