Saint xzorcist, Who Cast Out the Backdoor

Patron of open source libraries, over-helpful contributors, and those who eye benchmarks with suspicion.

Life

On 29 March 2024 Andres Freund announced CVE-2024-3094: a backdoor had been hidden in the source of the xz compression library, starting from 5.6.0. Through a chain of obfuscations, the build extracted an object file from a fake test file and altered liblzma, opening a door in SSH access. It had been introduced, over years of patience, by a trusted contributor; it was found by chance, after noticing a few milliseconds too many.

Prayer

O Saint xzorcist, who casts the backdoor out of the possessed library, give us eyes to see the evil hidden in trusted code. Amen.

How to celebrate

Celebrated by reverting to a clean version of xz, verifying the supply chain, and thanking whoever notices the milliseconds too many.

An over-helpful contributor is code to read twice.