[PATCH 0/1] Xz backdoor / JiaT75 cleanup for libarchive

  • Done
  • quality assurance status badge
Details
5 participants
  • Efraim Flashner
  • John Kehayias
  • Leo Famulari
  • Ludovic Courtès
  • pelzflorian (Florian Pelz)
Owner
unassigned
Submitted by
Leo Famulari
Severity
normal
Merged with
L
L
Leo Famulari wrote on 31 Mar 22:44 +0200
(address . guix-patches@gnu.org)
cover.1711917891.git.leo@famulari.name
The malicious actor that attacked Xz was also active in the libarchive
codebase:


This patch cherry-picks a fix for a potential vulnerability added by
this entity. The patch file includes annotations.

Please test with packages that directly use libarchive! For example:

------
$ ./pre-inst-env guix package -s . | recsel -e '(dependencies ~ "libarchive")' -p name,synopsis,location
name: dwarfs
synopsis: Fast high compression read-only file system
location: gnu/packages/file-systems.scm:2106:2

name: patool
synopsis: Portable archive file manager
location: gnu/packages/patool.scm:37:2

name: gnome-boxes
synopsis: View, access, and manage remote and virtual systems
location: gnu/packages/gnome.scm:12554:2

name: proot
synopsis: Unprivileged chroot, bind mount, and binfmt_misc
location: gnu/packages/linux.scm:8449:2

name: geary
synopsis: GNOME email application built around conversations
location: gnu/packages/gnome.scm:12630:2

name: tesseract-ocr
synopsis: Optical character recognition engine
location: gnu/packages/ocr.scm:104:2

name: tesseract-ocr
synopsis: Optical character recognition engine
location: gnu/packages/ocr.scm:192:2

name: reprepro
synopsis: Debian package repository producer
location: gnu/packages/debian.scm:610:2

name: libjami
synopsis: Jami core library and daemon
location: gnu/packages/jami.scm:85:2

name: diffoscope
synopsis: Compare files, archives, and directories in depth
location: gnu/packages/diffoscope.scm:75:2

name: geeqie
synopsis: Lightweight GTK+ based image viewer
location: gnu/packages/image-viewers.scm:235:2

name: samba
synopsis: The standard Windows interoperability suite of programs for GNU and Unix
location: gnu/packages/samba.scm:296:2

name: gpaste
synopsis: Clipboard management system for GNOME Shell
location: gnu/packages/gnome-xyz.scm:1012:2

name: libextractor
synopsis: Library to extract meta-data from media files
location: gnu/packages/gnunet.scm:87:2

name: unrar-free
synopsis: Extract files from RAR archives
location: gnu/packages/compression.scm:2813:2

name: archivemount
synopsis: Tool for mounting archive files with FUSE
location: gnu/packages/linux.scm:4034:2

name: rpm
synopsis: The RPM Package Manager
location: gnu/packages/package-management.scm:934:2

name: nix
synopsis: The Nix package manager
location: gnu/packages/package-management.scm:804:2

name: gvfs
synopsis: Userspace virtual file system for GIO
location: gnu/packages/gnome.scm:7000:2

name: claws-mail
synopsis: GTK-based Email client
location: gnu/packages/mail.scm:1753:2

name: kbackup
synopsis: Backup program with an easy-to-use interface
location: gnu/packages/kde-utils.scm:438:2

name: cmake-minimal-cross
synopsis: Cross-platform build system
location: gnu/packages/cmake.scm:411:2

name: scilab
synopsis: Software for engineers and scientists
location: gnu/packages/maths.scm:9708:2

name: pixz
synopsis: Parallel indexing implementation of LZMA
location: gnu/packages/compression.scm:1037:2

name: cmake-minimal
synopsis: Cross-platform build system
location: gnu/packages/cmake.scm:263:2

name: python-fsspec
synopsis: File-system specification
location: gnu/packages/python-xyz.scm:27706:2

name: libostree
synopsis: Operating system and container binary deployment and upgrades
location: gnu/packages/package-management.scm:1958:2

name: cmake
synopsis: Cross-platform build system
location: gnu/packages/cmake.scm:346:2

name: meandmyshadow
synopsis: Puzzle/platform game
location: gnu/packages/games.scm:1788:2

name: reprotest
synopsis: Build software and check it for reproducibility
location: gnu/packages/diffoscope.scm:247:2

name: gimp-next
synopsis: GNU Image Manipulation Program
location: gnu/packages/gimp.scm:415:2

name: rdup
synopsis: Provide a list of files to backup
location: /home/leo/work/guix/gnu/packages/backup.scm:370:2

name: irods-client-icommands
synopsis: Data management software
location: gnu/packages/irods.scm:170:2

name: nestopia-ue
synopsis: Nintendo Entertainment System (NES/Famicom) emulator
location: gnu/packages/emulators.scm:1363:2

name: avogadrolibs
synopsis: Libraries for chemistry, bioinformatics, and related areas
location: gnu/packages/chemistry.scm:74:2

name: swi-prolog
synopsis: ISO/Edinburgh-style Prolog interpreter
location: gnu/packages/prolog.scm:88:2

name: evince
synopsis: GNOME's document viewer
location: gnu/packages/gnome.scm:2669:2

name: singularity
synopsis: Container platform
location: gnu/packages/linux.scm:5245:2

name: pqiv
synopsis: Powerful image viewer with minimal UI
location: gnu/packages/image-viewers.scm:896:2

name: python-libarchive-c
synopsis: Python interface to libarchive
location: gnu/packages/python-xyz.scm:16283:2

name: python-conda-package-handling
synopsis: Create and extract conda packages of various formats
location: gnu/packages/package-management.scm:1105:2

name: opencpn
synopsis: Chart plotter and marine GPS navigation software
location: gnu/packages/geo.scm:2473:2

name: midori
synopsis: Lightweight graphical web browser
location: gnu/packages/web-browsers.scm:106:2

name: appstream-glib
synopsis: Library for reading and writing AppStream metadata
location: gnu/packages/glib.scm:1346:2

name: libgxps
synopsis: GObject-based library for handling and rendering XPS documents
location: gnu/packages/gnome.scm:2069:2

name: libticalcs2
synopsis: Support library for TI calculators
location: gnu/packages/emulators.scm:1747:2

name: irods
synopsis: Data management software
location: gnu/packages/irods.scm:48:2

name: ardour
synopsis: Digital audio workstation
location: gnu/packages/audio.scm:775:2

name: libtifiles2
synopsis: File functions library for TI calculators
location: gnu/packages/emulators.scm:1712:2

name: flatpak
synopsis: System for building, distributing, and running sandboxed desktop applications
location: gnu/packages/package-management.scm:2011:2

name: epic5
synopsis: Epic5 IRC Client
location: gnu/packages/irc.scm:669:2

name: file-roller
synopsis: Graphical archive manager for GNOME
location: gnu/packages/gnome.scm:7628:2

name: rpi-imager
synopsis: Raspberry Pi Imaging Utility
location: gnu/packages/raspberry-pi.scm:467:2

name: fwupd
synopsis: Daemon to allow session software to update firmware
location: gnu/packages/firmware.scm:211:2

name: totem-pl-parser
synopsis: Library to parse and save media playlists for GNOME
location: gnu/packages/gnome.scm:6075:1

name: osinfo-db-tools
synopsis: Tools for managing the osinfo database
location: gnu/packages/virtualization.scm:2691:2

name: ark
synopsis: Graphical archiving tool
location: gnu/packages/kde-utils.scm:54:2

name: vlc
synopsis: Audio and video framework
location: gnu/packages/video.scm:2365:2

name: fpm
synopsis: Package building and mangling tool
location: gnu/packages/package-management.scm:2118:2

name: hydrogen
synopsis: Drum machine
location: gnu/packages/music.scm:869:2

name: gnome-autoar
synopsis: Archives integration support for GNOME
location: gnu/packages/gnome.scm:9531:2

name: python-py7zr
synopsis: 7-zip in Python
location: gnu/packages/python-compression.scm:444:2

name: zathura-cb
synopsis: Comic book support for zathura (libarchive backend)
location: gnu/packages/pdf.scm:516:2

name: python-rarfile
synopsis: RAR archive reader for Python
location: gnu/packages/python-xyz.scm:19616:2

name: epiphany
synopsis: GNOME web browser
location: gnu/packages/gnome.scm:7160:2

name: gnome-arcade
synopsis: Minimal MAME frontend
location: gnu/packages/emulators.scm:1962:2

name: zeal
synopsis: Offline documentation browser inspired by Dash
location: gnu/packages/documentation.scm:412:4

name: pcsxr
synopsis: PlayStation emulator
location: gnu/packages/emulators.scm:2057:4

name: atril
synopsis: Document viewer for Mate
location: gnu/packages/mate.scm:683:2
------

Leo Famulari (1):
gnu: libarchive: Fix a potential security issue.

gnu/local.mk | 1 +
gnu/packages/backup.scm | 19 ++++++++
...libarchive-remove-potential-backdoor.patch | 47 +++++++++++++++++++
3 files changed, 67 insertions(+)
create mode 100644 gnu/packages/patches/libarchive-remove-potential-backdoor.patch


base-commit: 4d79a9cd6b5f0d8c5afbab0c6b70ae42740d5470
--
2.41.0
L
L
Leo Famulari wrote on 31 Mar 22:50 +0200
(no subject)
(address . control@debbugs.gnu.org)
ZgnMlFiqNWIe5-9f@jasmine.lan
merge 70114 70113
J
J
John Kehayias wrote on 2 Apr 05:23 +0200
Re: [bug#70113] [PATCH 1/1] gnu: libarchive: Fix a potential security issue.
(name . Leo Famulari)(address . leo@famulari.name)
87il10wipx.fsf@protonmail.com
Hi Leo,

On Sun, Mar 31, 2024 at 04:44 PM, Leo Famulari wrote:

Toggle quote (8 lines)
>
> * gnu/packages/backup.scm (libarchive)[replacement]: New field.
> (libarchive/fixed): New variable.
> * gnu/packages/patches/libarchive-remove-potential-backdoor.patch: New file.
> * gnu/local.mk (dist_patch_DATA): Add it.
>

Overall changes look good, but I have not had a chance to try it locally
(building or dependents).

[...]

Toggle quote (13 lines)
> +(define-public libarchive/fixed
> + (package
> + (inherit libarchive)
> + (version "3.6.1")
> + (source
> + (origin
> + (method url-fetch)
> + (uri (list (string-append "https://libarchive.org/downloads/libarchive-"
> + version ".tar.xz")
> + (string-append "https://github.com/libarchive/libarchive"
> + "/releases/download/v" version "/libarchive-"
> + version ".tar.xz")))

In light of the xz backdoor, perhaps we should just do a git checkout of
the v3.6.1 tag rather than the tarballs? Assuming that works, of course.

I haven't had a chance to look at potential ABI changes, but perhaps at
least v3.6.2 is graftable? That also lists a security update (as well as
later versions).

Or, if it is easier and this is tested on your end, let's push this and
do an upgrade to the latest on a branch. I would volunteer mesa-updates,
but Cuirass has been stuck all day not building anything, so I don't
know what will end up being quickest (which branch or a new one).

Thanks for the quick work!
John
E
E
Efraim Flashner wrote on 2 Apr 15:24 +0200
(name . John Kehayias)(address . john.kehayias@protonmail.com)
ZgwG9F56NpS1YGt-@3900XT
On Tue, Apr 02, 2024 at 03:23:44AM +0000, John Kehayias via Guix-patches via wrote:
Toggle quote (16 lines)
> Hi Leo,
>
> On Sun, Mar 31, 2024 at 04:44 PM, Leo Famulari wrote:
>
> > https://github.com/libarchive/libarchive/pull/2101
> >
> > * gnu/packages/backup.scm (libarchive)[replacement]: New field.
> > (libarchive/fixed): New variable.
> > * gnu/packages/patches/libarchive-remove-potential-backdoor.patch: New file.
> > * gnu/local.mk (dist_patch_DATA): Add it.
> >
>
> Overall changes look good, but I have not had a chance to try it locally
> (building or dependents).
>

This looks like what I was going to suggest

Toggle quote (18 lines)
> [...]
>
> > +(define-public libarchive/fixed
> > + (package
> > + (inherit libarchive)
> > + (version "3.6.1")
> > + (source
> > + (origin
> > + (method url-fetch)
> > + (uri (list (string-append "https://libarchive.org/downloads/libarchive-"
> > + version ".tar.xz")
> > + (string-append "https://github.com/libarchive/libarchive"
> > + "/releases/download/v" version "/libarchive-"
> > + version ".tar.xz")))
>
> In light of the xz backdoor, perhaps we should just do a git checkout of
> the v3.6.1 tag rather than the tarballs? Assuming that works, of course.

In this case it was just the patch which didn't do (just) what the
commit message said. IMO applying this patch will make us safe from this
potential JiaT75 backdoor, no bootstrapping from source needed.

Toggle quote (9 lines)
> I haven't had a chance to look at potential ABI changes, but perhaps at
> least v3.6.2 is graftable? That also lists a security update (as well as
> later versions).
>
> Or, if it is easier and this is tested on your end, let's push this and
> do an upgrade to the latest on a branch. I would volunteer mesa-updates,
> but Cuirass has been stuck all day not building anything, so I don't
> know what will end up being quickest (which branch or a new one).

If it turns out that we need to move forward a bit to guard against
other CVEs then this patch should be forward compatible, considering it
was just added to the libarchive repository.

Toggle quote (3 lines)
> Thanks for the quick work!
> John

Indeed. Thanks!

--
Efraim Flashner <efraim@flashner.co.il> ????? ?????
GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEoov0DD5VE3JmLRT3Qarn3Mo9g1EFAmYMBvQACgkQQarn3Mo9
g1HyLg//TPAkGSR0VWtg1lqvIEuXZ1+mB2S+BKd1LBIAy62S8brhfLVSkC/o23Li
4ogrMWlrLFrLeTIC8U9PX+//FBOpTh8UgNUqcATNGoozhK9nRgkTtddg+ClGkSyb
CEaZy4iVyfGHlJ9DwiTR4moz89XxA2Ax1c01MR38rgRi3keprPgHhXWguKBnGXPW
3hyln4Q9xqzKeRbiAUF0a8SJEzJFHF/CjA3556dLuK6pNqvqd1L7fv+efZMDaPVp
LHpg3gTKMhl14vl/GwFwzO9EJcMZv4ltjjMLonHHvea8ZnhmRvWZb5Jf72hdG8QZ
F2vYUGtVFXN0V/o8sALraI6MFcJff2Plm0BAqm8Kuqo78wBfhN/wAOe43K36uhCO
7hiqSoifrziItHnbHxRNhtHcTLIzh9v9yhjbZBL3atZiwo5MHMsRbw7a+/XwxSZ6
+aVaiP59RDXrampRQEbJMYtE++titfMRDvhQUH3cUYwf47lUDpKNhHGONHFW7V7e
cPRsOSqmAShcCSWjlzF95gOwhlt2eUGv5GZq7isLNuHz1f7KZeHpF3LIGAhvmvC7
dwiFBIGXXmx5vkTFHXqbEHH+ZuqzmaDSTLI6pHwZbABAQBBjkLrN9fAr9wtzcbte
Gmf0zvCgAJJ7hgCCNGLtVhw2lbofPIGj0eRYcGNDEJDEAJ7R/3c=
=+yka
-----END PGP SIGNATURE-----


P
P
pelzflorian (Florian Pelz) wrote on 2 Apr 15:45 +0200
(name . John Kehayias)(address . john.kehayias@protonmail.com)
871q7nev3k.fsf@pelzflorian.de
Hello,

John Kehayias via Guix-patches via <guix-patches@gnu.org> writes:
Toggle quote (16 lines)
>> +(define-public libarchive/fixed
>> + (package
>> + (inherit libarchive)
>> + (version "3.6.1")
>> + (source
>> + (origin
>> + (method url-fetch)
>> + (uri (list (string-append "https://libarchive.org/downloads/libarchive-"
>> + version ".tar.xz")
>> + (string-append "https://github.com/libarchive/libarchive"
>> + "/releases/download/v" version "/libarchive-"
>> + version ".tar.xz")))
>
> In light of the xz backdoor, perhaps we should just do a git checkout of
> the v3.6.1 tag rather than the tarballs? Assuming that works, of course.

Not having followed the details, I believe the git checkout contained an
incomplete part of the malicious code too, from what Joshua Branson (I
guess the sender is him?) cites from Phoronix

jbranso@dismail.de writes:
Toggle quote (7 lines)
> The malicious injection present in the xz versions 5.6.0 and 5.6.1
> libraries is obfuscated and only included in full in the download package
> - the Git distribution lacks the M4 macro that triggers the build
> of the malicious code. The second-stage artifacts are present in
> the Git repository for the injection during the build time, in
> case the malicious M4 macro is present.

It doesn’t look like avoiding tarballs gives us more verified code.

Regards,
Florian
L
L
Leo Famulari wrote on 4 Apr 00:08 +0200
(name . John Kehayias)(address . john.kehayias@protonmail.com)
Zg3TTEwIZkIObXc0@jasmine.lan
On Tue, Apr 02, 2024 at 03:23:44AM +0000, John Kehayias wrote:
Toggle quote (3 lines)
> Overall changes look good, but I have not had a chance to try it locally
> (building or dependents).

I successfully tested with the file-roller package, which depends
directly on libarchive and no other related packages. I think it's a
reasonable basic test case.

I agree it's a good idea to look into a more comprehensive update to
libarchive, but I just wanted to get this patch in ASAP.

Pushed as 629614c7a3f9283306939402f1ff46914f327c21
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEaEByLu7k06ZO5T6saqwZY3V/R/8FAmYN00wACgkQaqwZY3V/
R/8IqhAAre19kcT27tbQVcEhFNhsBFRmtAf6FZ+Vnr8Z9yx7X4yYkr10l0Q9yzta
aU5p5IMr5QjK8N3g0o2tZbBoTZybDtbhL7ra8C4K6JBnn623yJIbbi46jJoMKz8V
H+1IYMPtpr/CU4pxZiK+4LQS9poXlNiFnUxKOs4OQUylZRQvrz/ifnbfCRmHGWoZ
xt116HTrxfb70jwtWptzIEJwpSTXWDaOidDygCihH38YbOG20zRDFrEdea3ciAiZ
4rink768fYZSjBeAWcbFA92QAgbrmI4lO8mfLi1y1uwTdkqV9b2zk7Eh2BOalE12
txJCHD5JG01nnooquFZjCaEbwKf4JPZV2Y7kb9UXRa63x/0u0RtDP3AznABjcRD3
vgvdcmwr41FPiSgKI/Cm4U8RBwLRebKNGMoz9rHzr5xXv5ana/54VPugQZNmEqYx
ZS5HOtjuB9OdZ/C6t53QIDnwLFts5OVwCq3EPiXebU6hfffVKpCDPFyeDPMPEz0I
rgS3i58qM8x3XMJ2teuDZy+YUBQ2aCg7IK9xBp4I/iXj8Fu+AFSHAg08W7bfPO4m
qaV0SiJZQRrV61harg7nM7Z02VxIJI0CeQZBQQhmFbG2hNcbIS+21vJk74cqYowg
AYWGuD9Kf3f0CFdLtQgWHBR1l4g4h6KAE3Gxdkm354wUtcQijjo=
=h8Y8
-----END PGP SIGNATURE-----


J
J
John Kehayias wrote on 4 Apr 04:38 +0200
(name . pelzflorian (Florian Pelz))(address . pelzflorian@pelzflorian.de)
8734s1x35x.fsf@protonmail.com
Hello,

On Tue, Apr 02, 2024 at 03:45 PM, pelzflorian (Florian Pelz) wrote:

Toggle quote (35 lines)
> Hello,
>
> John Kehayias via Guix-patches via <guix-patches@gnu.org> writes:
>>> +(define-public libarchive/fixed
>>> + (package
>>> + (inherit libarchive)
>>> + (version "3.6.1")
>>> + (source
>>> + (origin
>>> + (method url-fetch)
>>> + (uri (list (string-append "<https://libarchive.org/downloads/libarchive>-"
>>> + version ".tar.xz")
>>> + (string-append "<https://github.com/libarchive/libarchive>"
>>> + "/releases/download/v" version "/libarchive-"
>>> + version ".tar.xz")))
>>
>> In light of the xz backdoor, perhaps we should just do a git checkout of
>> the v3.6.1 tag rather than the tarballs? Assuming that works, of course.
>
> Not having followed the details, I believe the git checkout contained an
> incomplete part of the malicious code too, from what Joshua Branson (I
> guess the sender is him?) cites from Phoronix
> <https://lists.gnu.org/archive/html/guix-devel/2024-04/msg00002.html>:
>
> jbranso@dismail.de writes:
>> The malicious injection present in the xz versions 5.6.0 and 5.6.1
>> libraries is obfuscated and only included in full in the download package
>> - the Git distribution lacks the M4 macro that triggers the build
>> of the malicious code. The second-stage artifacts are present in
>> the Git repository for the injection during the build time, in
>> case the malicious M4 macro is present.
>
> It doesn’t look like avoiding tarballs gives us more verified code.
>

Well, it removes one step where something can be added. From what I
understand release tarballs don't match a git checkout as often build
artifacts (from autotools) are added, so it is just another potential
attack vector. Indeed, it was only part of the attack here, but I do
believe there is general support for trying to favor git checkouts
when we can (there is overhead and I think issues for parts in
bootstrapping, to get git). Certainly not perfect, but gets us to
"just" the source. One can still do things with access of course.

Thanks Leo for the quick work here and pushing the patch, much
appreciated!

John
L
L
Ludovic Courtès wrote on 7 Apr 22:41 +0200
control message for bug #70114
(address . control@debbugs.gnu.org)
87ttkcoqhs.fsf@gnu.org
tags 70114 + security
quit
?
Your comment

This issue is archived.

To comment on this conversation send an email to 70114@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it
mumi current 70114
Then, you may apply the latest patchset in this issue (with sign off)
mumi am -- -s
Or, compose a reply to this issue
mumi compose
Or, send patches to this issue
mumi send-email *.patch