News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise. Parent comment

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by metzmanj on Friday March 29, 2024 @03:05PM (#39867772)
>Woha, is this legit or some sort of scam on Google in some way?:

I work on OSS-Fuzz.

As far as I can tell, the author's PRs do not compromise OSS-Fuzz in any way.

OSS-Fuzz doesn't trust user code for this very reason.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by packetlost on Friday March 29, 2024 @03:37PM (#39868117)
It looks more like they disabled a feature of oss-fuzz that would've caught the exploit, no?
[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by metzmanj on Friday March 29, 2024 @04:02PM (#39868391)
That's what people are saying though I haven't had the chance to look into this myself.

Fuzzing isn't really the best tool for catching bugs the maintainer intentionally inserted though.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by bombcar on Friday March 29, 2024 @04:26PM (#39868634)
It's more likely that fuzzing would blow up on new code and they wanted an excuse to remove it.

After all, if it hadn't had a performance regression (someone could submit a PR fixing whatever slowed it down, heh) it still wouldn't be known.

[ Parent | on HN ]