3 ms·
I think this has been in the making for almost a year. The whole ifunc infrastructure was added in June 2023 by Hans Jansen and Jia Tan. The initial patch is "a
by formerly_proven 3y ago
I think this has been in the making for almost a year. The whole ifunc infrastructure was added in June 2023 by Hans Jansen and Jia Tan. The initial patch is "authored by" Lasse Collin in the git metadata, but the code actually came from Hans Jansen: https://github.com/tukaani-project/xz/commit/ee44863ae88e377a5df10db007ba9bfadde3d314 https://github.com/tukaani-project/xz/commit/ee44863ae88e377...
> Thanks to Hans Jansen for the original patch.
https://github.com/tukaani-project/xz/pull/53 https://github.com/tukaani-project/xz/pull/53
There were a ton of patches by these two subsequently because the ifunc code was breaking with all sorts of build options and obviously caused many problems with various sanitizers. Subsequently the configure script was modified multiple times to detect the use of sanitizers and abort the build unless either the sanitizer was disabled or the use of ifuncs was disabled. That would've masked the payload in many testing and debugging environments.
The hansjans162 Github account was created in 2023 and the only thing it did was add this code to liblzma. The same name later applied to do a NMU at Debian for the vulnerable version. Another "<name><number>" account (which only appears here, once) then pops up and asks for the vulnerable version to be imported: https://www.mail-archive.com/search?l=debian-bugs-dist@lists.debian.org&q=from:%22krygorin4545%22 https://www.mail-archive.com/search?l=debian-bugs-dist@lists...
- zb3 3y agoAlso I saw this hans jansen user pushing for merging the 5.6.1 update in debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067708 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067708
- hxelk1 3y agoFrom: krygorin4545 <krygorin4545@proton.me> To: "1067708@bugs.debian.org" <1067708@bugs.debian.org> Cc: "sebastian@breakpoint.cc" <sebastian@breakpoint.cc>, "bage@debian.org" <bage@debian.org> Subject: Re: RFS: xz-utils/5.6.1-0.1 [NMU] -- XZ-format compression utilities Date: Tue, 26 Mar 2024 19:27:47 +0000 Also seeing this bug. Extra valgrind output causes some failed tests for me. Looks like the new version will resolve it. Would like this new version so I can continue work. -- Wow. (Edited for clarity.)
- zb3 3y agoAlso I see this PR: https://github.com/tukaani-project/xz/pull/64 https://github.com/tukaani-project/xz/pull/64
- bluecheese33 3y ago> because the ifunc code was breaking with all sorts of build options and obviously caused many problems with various sanitizers for example, https://github.com/google/oss-fuzz/pull/10667 https://github.com/google/oss-fuzz/pull/10667
- bed99 3y ago1 week ago "Hans Jansen" user "hjansen" was created in debian and opened 8 PRs including the upgrade to 5.6.1 to xz-utils From https://salsa.debian.org/users/hjansen/activity https://salsa.debian.org/users/hjansen/activity Author: Hans Jansen <hansjansen162@outlook.com> - [Debian Games / empire](https://salsa.debian.org/games-team/empire https://salsa.debian.org/games-team/empire): opened merge request "!2 New upstream version 1.17" - March 17, 2024 - [Debian Games / empire](https://salsa.debian.org/games-team/empire https://salsa.debian.org/games-team/empire): opened merge request "!1 Update to upstream 1.17" - March 17, 2024 - [Debian Games / libretro / libretro-core-info](https://salsa.debian.org/games-team/libretro/libretro-core-info https://salsa.debian.org/games-team/libretro/libretro-core-i...): opened merge request "!2 New upstream version 1.17.0" - March 17, 2024 - [Debian Games / libretro / libretro-core-info](https://salsa.debian.org/games-team/libretro/libretro-core-info https://salsa.debian.org/games-team/libretro/libretro-core-i...): opened merge request "!1 Update to upstream 1.17.0" - March 17, 2024 - [Debian Games / endless-sky](https://salsa.debian.org/games-team/endless-sky https://salsa.debian.org/games-team/endless-sky): opened merge request "!6 Update upstream branch to 0.10.6" - March 17, 2024 - [Debian Games / endless-sky](https://salsa.debian.org/games-team/endless-sky https://salsa.debian.org/games-team/endless-sky): opened merge request "!5 Update to upstream 0.10.6" - March 17, 2024 - [Debian / Xz Utils](https://salsa.debian.org/debian/xz-utils https://salsa.debian.org/debian/xz-utils): opened merge request "!1 Update to upstream 5.6.1" - March 17, 2024
- amluto 3y agoWow, what a big pile of infrastructure for a non-optimization. An internal call via ifunc is not magic — it’s just a call via the GOT or PLT, which boils down to function pointers. An internal call through a hidden visibility function pointer (the right way to do this) is also a function pointer. The even better solution is a plain old if statement, which implements the very very fancy “devirtualization” optimization, and the result will be effectively predicted on most CPUs and is not subject to the whole pile of issue that retpolines are needed to work around.
- account42 3y agoRight, IFUNCs make sense for library function where you have the function pointer indirection anyway. Makes much less sense for internal functions - only argument over a regular function pointer would be the pointer being marked RO after it is resolved (if the library was linked with -z relro -z now), but an if avoids even that issue.
- snvzz 3y ago>Hans Jansen and Jia Tan Are they really two people conspiring? Unless proven otherwise, it is safe to assume one is just a pseudonym alias of the other.
- EasyMark 3y agoor possibly just one person acting as two, or a group of people?
- cutemonster 3y agoOr a group managing many identities, backdooring many different projects
- formerly_proven 3y agoMake it two years. Jia Tan getting maintainer access looks like it is almost certainly to be part of the operation. Lasse Colling mentioned multiple times how Jia has helped off-list and to me it seems like Jia befriended Lasse as well (see how Lasse talks about them in 2023). Also the pattern of astroturfing dates back to 2022. See for example this thread where Jia, who has helped at this point for a few weeks, posts a patch, and a <name><number>@protonmail (jigarkumar17) user pops up and then bumps the thread three times(!) lamenting the slowness of the project and pushing for Jia to get commit access: https://www.mail-archive.com/xz-devel@tukaani.org/msg00553.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00553.h... Naturally, like in the other instances of this happening, this user only appears once on the internet.
- tootie 3y agoDoes anybody know anything about Jia Tan? Is it likely just a made up persona? Or is this a well-known person.
- SZJX 3y agoIt’s certainly a pseudonym just like all the other personas we’ve seen popping up on the mailing list supporting this “Jia Tan” in these couple of years. For all intents and purposes they can be of any nationality until we know more.
- Ill_Yam_689 3y agoIt seems like Hans Jansen has also an account on proton.me (hansjansen162@proton.me) with the Outlook address configured as recovery-email.