Re: xz backdoor

[Kevin Kofler]

Lennart Poettering wrote:
> It *literally* is just sending a text string "READY=1" in an AF_UNIX
> datagram to a socket whose path is provided to you in the
> $NOTIFY_SOCKET env var.

I see so many ways one can get this wrong. E.g., using some abstraction for 
the socket write that can also write to regular files, without checking that 
"$NOTIFY_SOCKET" is really a socket (or checking it with a TOCTOU 
vulnerability), introducing an arbitrary file overwrite vulnerability.

Kevin Kofler