Re:The xz attack shell script
by ihsoy on Tuesday April 02, 2024 @05:51PM
(#39911249)
That seems to be largely grasped at straws and connecting dots without reason.
For example oss-fuzz was building xz by cloning the github repo directly. There was never a chance for oss-fuzz to discover the backdoor, because only the tarball had it, not the repo itself. So that oss-fuzz PR might genuinely just be a genuine thing unrelated to the backdoor.
Re:The xz attack shell script
by sp332 on Tuesday April 02, 2024 @06:50PM
(#39911711)
The ifunc part looked more legitimate, it was used to switch between optimized implementations of CRC. So that part was in the git repo. https://github.com/google/oss-fuzz/pull/10667
For example oss-fuzz was building xz by cloning the github repo directly. There was never a chance for oss-fuzz to discover the backdoor, because only the tarball had it, not the repo itself. So that oss-fuzz PR might genuinely just be a genuine thing unrelated to the backdoor.