From 3c9f3f962aa40c57d5336a473787cb0d62f9a188 Mon Sep 17 00:00:00 2001 From: inference Date: Mon, 1 Apr 2024 17:13:24 +0000 Subject: [PATCH] Update webpage "News" from version "1.0.1-beta.1" to "1.1.0-beta.1" --- news.xhtml | 44 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 43 insertions(+), 1 deletion(-) diff --git a/news.xhtml b/news.xhtml index 51c925d..2a79f1c 100644 --- a/news.xhtml +++ b/news.xhtml @@ -1,7 +1,7 @@ - + @@ -34,12 +34,54 @@ +
+

2024-04-01

+
+

SSH Key Update

+

On 2024-03-29, a backdoor was discovered in the + xz-utils + software. Inferencium systems did have the affected versions of + this software installed, and the tools were used. The software has since been downgraded to + the last-known safe version.

+

After extensive research, it + has been discovered + that specific criteria must be met for the backdoor to be effective. Based on + what is known, Inferencium systems are unaffected by this attack + for the following reasons:

+
    +
  • Inferencium systems run Gentoo Linux, which does not include Debian and Red Hat + OpenSSH patches.
    • +
  • Inferencium systems use musl libc, not glibc. As musl does not support glibc's + non-standard IFUNC functionality, the backdoor cannot run.
    • +
  • Inferencium systems use Clang as the system compiler, and lld as the system + linker, not GCC and ld.
    • +
  • Inferencium systems use OpenRC as the init system, not systemd. libsystemd and + systemd-notify do not work with OpenRC.
    • +
+

The only criteria met by Inferencium systems is amd64 as the system + architecture; this is not enough for the backdoor to be effective. Even if all criteria + other than running glibc were met, Inferencium systems would still be unaffected by this + attack due to musl not supporting the required IFUNC functionality.

+

Despite the evidence, it is unknown exactly what this malicious code does and is + capable of in entirety. As a precautionary measure, I have generated a new SSH key and + classifed the previous key as compromised. You can find my new key on the + Key webpage.

+

There is no evidence that my previous key was compromised, so this is entirely a + precautionary measure. All files and Git commits, tags, and releases signed with the + previous key, even after discovery of the backdoor, up to 2024-04-01, are secure and validly + signed by me; the key should not be trusted after this date.

+
+

2024-02-01