How much using Qubes would minimize impact of XZ backdoor if it actually got into the stable channel of Fedora/Debian?

General Discussion
1

I wonder how much less would the impact be on Qubes compared to a monolithic Linux distro, if XZ backdoor was never detected?

2

The vulnerability, as of today, is only known to allow to execute remote code through the SSH daemon.

By default, Qubes OS doesn’t run any ssh daemon, and if you did, it would only be in sys-net (or you would have to do port forwarding to the qube with ssh). In worst case scenario, only the qube where ssh is reachable who be compromised.

2 Likes
3

if it actually got into the stable channel of Fedora/Debian

It has not got there:

I wonder how much less would the impact be on Qubes compared to a monolithic Linux distro, if XZ backdoor was never detected?

“As of March 29, reverse engineering of the backdoor is still ongoing.” (source)

4

On this github gist, there are hourly updates about the vulnerability xz-utils backdoor situation (CVE-2024-3094) · GitHub

1 Like
5

Why do you call it vulnerability?
IIUC, it is a backdoor.

6

It’s a RCE vulnerability which was introduced. XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable." | Hacker News

The certificate the attacker uses to authenticate would contain the payload. Some researcher was able to replace the hardcoded certificate check with their own and made a demo repository where you could test the RCE out. Without the correct cert checked for in the original code nobody can exploit the vulnerability unless they modify it.

So yeah it’s kinda both a vulnerability and a backdoor since it’s gated.

7

Isn’t a backdoor a type of vulnerability?

8

Vulnerability is unintentional while backdoor is intentional, I believe

1 Like
9

Do you have a source for vulnerabilities being unintentional? I haven’t heard of this. For example, Vulnerability (computing) - Wikipedia doesn’t seem to mention unintentionality as a criterion, as far as I can tell.

11

If you add the flaw deliberately, it is normally called a bugdoor. The XZ backdoor was not a flaw, the software was working as intended.

12

I call this bikeshedding.

2 Likes
13

can some1 remind me please what it’s called when open source deliberately used as trust source and then inject some malicious code into it?

14

Moderation note—to all concerned: this vocabulary battle is off-topic, please either reply to the OP or refrain from posting further in this thread.

1 Like
15

OK sorry

2 Likes