Re: xz backdoor

[Kaelyn <kaelyn.alexi@protonmail.com>]

Hi Reza,

On Monday, April 1st, 2024 at 12:46 PM, Reza Housseini <reza.housseini@gmail.com> wrote:

> 
> 
> Hi Guixers
> 
> Just stumbled upon this recently discovered supply chain attack on xz,
> inserting a backdoor via test files [1, 2]. And it made me wondering,
> what would have been the effects on guix and how can we potentially
> avoid it?

Thank you for your email about the xz backdoor! To hopefully help with your questions, there has already been some discussion on guix-devel about the backdoor and how it should be handled now and in the future:

https://lists.gnu.org/archive/html/guix-devel/2024-03/msg00281.html
https://lists.gnu.org/archive/html/guix-devel/2024-03/msg00292.html

The quick summary is that Guix currently shouldn't be affected because a) Guix currently packages xz 5.2.8, which predates the backdoor, and b) the backdoor includes checks based on absolute paths e.g. under /usr and Guix executable paths generally don't match the patterns checked for.

Cheers,
Kaelyn

> Stay safe!
> Reza
> 
> [1] https://www.openwall.com/lists/oss-security/2024/03/29/4
> [2] https://access.redhat.com/security/cve/cve-2024-3094#cve-cvss-v3