Messages in this thread | | | Date | Sat, 30 Mar 2024 06:54:30 -0700 | From | Kees Cook <> | Subject | Re: [tech-board] [PATCH 00/11] xz: Updates to license, filters, and compression options |
| |
On Sat, Mar 30, 2024 at 02:48:48PM +0200, Lasse Collin wrote: > On 2024-03-29 Andrew Morton wrote: > > On Fri, 29 Mar 2024 14:51:41 -0600 Jonathan Corbet <corbet@lwn.net> > > wrote: > > > > > > Andrew (and anyone else), please do not take this code right now. > > > > > > > > Until the backdooring of upstream xz[1] is fully understood, we > > > > should not accept any code from Jia Tan, Lasse Collin, or any > > > > other folks associated with tukaani.org. It appears the domain, > > > > or at least credentials associated with Jia Tan, have been used > > > > to create an obfuscated ssh server backdoor via the xz upstream > > > > releases since at least 5.6.0. Without extensive analysis, we > > > > should not take any associated code. It may be worth doing some > > > > retrospective analysis of past contributions as well... > > > > > > > > Lasse, are you able to comment about what is going on here? > > > > > > FWIW, it looks like this series has been in linux-next for a few > > > days. Maybe it needs to come out, for now at least? > > > > Yes, I have removed that series. > > Thank you. None of these patches are urgent. I'm on a holiday and only > happened to look at my emails and it seems to be a major mess. > > My proper investigation efforts likely start in the first days of > April. That is, I currently know only a few facts which alone are bad > enough. > > Info will be updated here: https://tukaani.org/xz-backdoor/
Thanks; I appreciate the update! And I'm sorry this has happened to you. We'll all know more in the coming days. (I, too, am on vacation, wheee.)
-Kees
-- Kees Cook
| |