Audit Progress and Results

[ZyanKLee]

Due to a suspected security breach of the update server and code repository, there's
been a concerted effort by the NoiseTorch community to ensure the source code and
binaries are free from malicious code.

No malicious code has been found.

You can read more about the audit that was done here
and here.
Updates will now be retrieved from the project's releases page to avoid any risk
of this reoccurring. We thank everyone for their trust and the love that they've
shown towards the project in this unpleasant time.

---

Let's have an overview of what has been done and what is needed in regards of an audit of the current code state:

Item	Review 1	Review 2	Review 3	Result
latest binary	virustotal.com	-	-	done ✔️
assets/	virustotal.com	-	-	done ✔️
c/	@pinkuuu1 🔗	@TheDukeofErl 🔗	@Mordna 🔗	done ✔️
scripts/	@Dadadah 🔗	@ZyanKLee 🔗	@Snaddyvitch-Dispenser 🔗	done ✔️
vendor/	@TheDukeofErl 🔗	@ZyanKLee 🔗	-	done ✔️
*.go	@Dadadah 🔗	@principis 🔗	@Snaddyvitch-Dispenser 🔗	done ✔️
Makefile	@ZyanKLee 🔗	@maggick 🔗	-	done ✔️
lawl/pulseaudio	@AXDOOMER 🔗	@Snaddyvitch-Dispenser 🔗	-	done ✔️

If you can help with any of the open tasks (?), please do so and report your findings in this topic.
If you feel something is missing on the list, please comment with that info as well.

[Dadadah]

scripts/ looks good. These files are super simple, and I don't see any problems with them.

[Dadadah]

I've reviewed the rest of the GO code for this repo, aside from the untar file. We should probably move that to an external dependency, or alternatively run the tar command in a shell.

[TheDukeofErl]

I did a quick diff of untar.go against the upstream (https://github.com/golang/build/blob/master/internal/untar/untar.go) and it looked fine to me.

[Rififia]

The website to check the binaries is virustotal.com not totalvirus.com ^^
And BTW thanks for organizing all of this!

[ZyanKLee]

Fixed, thanks.

[ZyanKLee]

This looks imho quite good for the second day after the compromise of lawl's PC become known.

My first idea was to have three reviewers per item (at least the more complex items).
So I will leave this (and the pending PRs) open for another few days and hope, some more people will find their way here and can also review the code.

[CheaterTim]

I would but don't know go or c

[ZyanKLee]

I would but don't know go or c

It's never to late to learn :-D
Thanks for the offering, though.

[CADawg]

Hey, I'd be happy to be the 3rd reviewer for *.go

[ZyanKLee]

And please do not waste your time with the vendor/ folder. We could easily verify, that it has not been tampered with by deleting, go mod vendor'ing and finally git diff it.

[CADawg]

Thanks. I have checked through the .go files in the root and the scripts/ folder and can say that both look good to me.

[ZyanKLee]

Fabulous!
Then go is the first part, that's finished.

[ZyanKLee]

Oh, one more question: would you be willing to have a look at lawl/pulseaudio as well. Then we can rock that off as well.

[CADawg]

lawl/pulseaudio looks fine and fortunately much of the code is from the upstream.

[Mordna]

c/ is also good:

• Used upstream c-ringbuf to verify ringbuf.*
• Used upstream rnnoise to verify c/rnnoise using diff and manually checking the differences
• Manually checked c/ladspa

[ZyanKLee]

Thanks a lot!

[TeaDrinkingProgrammer]

I see that all parts are marked as done. Does this mean it is safe to download Noisetorch again?

[ZyanKLee]

Being cautious: as far as we can see, the code has not been tampered with.
I would advice to build the binary from source for now, though. Next steps would be to create a new official binary and make that available to the public. But I want to change some stuff before that.

[TeaDrinkingProgrammer]

Being cautious: as far as we can see, the code has not been tampered with. I would advice to build the binary from source for now, though. Next steps would be to create a new official binary and make that available to the public. But I want to change some stuff before that.

Thanks for the heads up.

[ZyanKLee]

Folks: YOU ARE AWESOME!
Thanks a lot for all the help with this code review. I'm glad you are here and helped out; I could not have done that without you (quite literally).

[mmojica53]

I ran trivy on the repo and there is several dependencies with vulnerabilities, if that helps

2022-05-23T20:51:21.793-0400	�[34mINFO�[0m	Number of language-specific files: 1
2022-05-23T20:51:21.793-0400	�[34mINFO�[0m	Detecting gomod vulnerabilities...

go.sum (gomod)
==============
Total: 23 (UNKNOWN: 8, LOW: 0, MEDIUM: 3, HIGH: 10, CRITICAL: 2)

+-----------------------------------+------------------+----------+-----------------------------------+--------------------------------------+---------------------------------------+
|              LIBRARY              | VULNERABILITY ID | SEVERITY |         INSTALLED VERSION         |            FIXED VERSION             |                 TITLE                 |
+-----------------------------------+------------------+----------+-----------------------------------+--------------------------------------+---------------------------------------+
| github.com/apache/thrift          | CVE-2020-13949   | HIGH     | 0.13.0                            | v0.14.0                              | libthrift: potential DoS when         |
|                                   |                  |          |                                   |                                      | processing untrusted payloads         |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2020-13949 |
+-----------------------------------+------------------+          +-----------------------------------+--------------------------------------+---------------------------------------+
| github.com/dgrijalva/jwt-go       | CVE-2020-26160   |          | 3.2.0+incompatible                |                                      | jwt-go: access restriction            |
|                                   |                  |          |                                   |                                      | bypass vulnerability                  |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2020-26160 |
+-----------------------------------+------------------+          +-----------------------------------+--------------------------------------+---------------------------------------+
| github.com/gogo/protobuf          | CVE-2021-3121    |          | 1.2.1                             | 1.3.2                                | gogo/protobuf:                        |
|                                   |                  |          |                                   |                                      | plugin/unmarshal/unmarshal.go         |
|                                   |                  |          |                                   |                                      | lacks certain index validation        |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2021-3121  |
+-----------------------------------+------------------+----------+-----------------------------------+--------------------------------------+---------------------------------------+
| github.com/miekg/dns              | CVE-2019-19794   | MEDIUM   | 1.0.14                            | 1.1.25-0.20191211073109-8ebf2e419df7 | golang-github-miekg-dns: predictable  |
|                                   |                  |          |                                   |                                      | TXID can lead to response forgeries   |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2019-19794 |
+-----------------------------------+------------------+----------+-----------------------------------+--------------------------------------+---------------------------------------+
| github.com/nats-io/jwt            | CVE-2020-26892   | CRITICAL | 0.3.2                             | v1.1.0                               | Use of Hard-coded Credentials         |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2020-26892 |
+                                   +------------------+----------+                                   +                                      +---------------------------------------+
|                                   | CVE-2020-26521   | HIGH     |                                   |                                      | NULL Pointer Dereference              |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2020-26521 |
+                                   +------------------+----------+                                   +--------------------------------------+---------------------------------------+
|                                   | GMS-2022-72      | UNKNOWN  |                                   | v2.0.1                               | Import token permissions              |
|                                   |                  |          |                                   |                                      | checking not enforced                 |
+                                   +------------------+          +                                   +                                      +                                       +
|                                   | GMS-2022-73      |          |                                   |                                      |                                       |
|                                   |                  |          |                                   |                                      |                                       |
+-----------------------------------+------------------+----------+-----------------------------------+--------------------------------------+---------------------------------------+
| github.com/nats-io/nats-server/v2 | CVE-2020-26892   | CRITICAL | 2.1.2                             | 2.1.9                                | Use of Hard-coded Credentials         |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2020-26892 |
+                                   +------------------+----------+                                   +                                      +---------------------------------------+
|                                   | CVE-2020-26521   | HIGH     |                                   |                                      | NULL Pointer Dereference              |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2020-26521 |
+                                   +------------------+          +                                   +--------------------------------------+---------------------------------------+
|                                   | CVE-2020-28466   |          |                                   | v2.2.0                               | Denial of service                     |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2020-28466 |
+                                   +------------------+          +                                   +                                      +---------------------------------------+
|                                   | CVE-2021-3127    |          |                                   |                                      | nats-server: mishandling              |
|                                   |                  |          |                                   |                                      | Import Token bindings may lead        |
|                                   |                  |          |                                   |                                      | to Incorrect Access Control           |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2021-3127  |
+                                   +------------------+          +                                   +--------------------------------------+---------------------------------------+
|                                   | CVE-2022-24450   |          |                                   | 2.7.2                                | nats-server: misusing the             |
|                                   |                  |          |                                   |                                      | "dynamically provisioned              |
|                                   |                  |          |                                   |                                      | sandbox accounts" feature             |
|                                   |                  |          |                                   |                                      |  authenticated user can...            |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2022-24450 |
+                                   +------------------+----------+                                   +--------------------------------------+---------------------------------------+
|                                   | GMS-2021-96      | UNKNOWN  |                                   | 2.1.9                                | Incorrect handling of                 |
|                                   |                  |          |                                   |                                      | credential expiry by NATS             |
|                                   |                  |          |                                   |                                      | Server                                |
+                                   +------------------+          +                                   +--------------------------------------+---------------------------------------+
|                                   | GMS-2021-97      |          |                                   | 2.2.0                                | Import loops in account               |
|                                   |                  |          |                                   |                                      | imports, nats-server DoS              |
+                                   +------------------+          +                                   +--------------------------------------+---------------------------------------+
|                                   | GMS-2021-98      |          |                                   | 2.1.9                                | Nil dereference in NATS JWT,          |
|                                   |                  |          |                                   |                                      | DoS of nats-server                    |
+                                   +------------------+          +                                   +--------------------------------------+---------------------------------------+
|                                   | GMS-2021-99      |          |                                   | 2.2.0                                | Import token permissions              |
|                                   |                  |          |                                   |                                      | checking not enforced                 |
+-----------------------------------+------------------+----------+-----------------------------------+--------------------------------------+---------------------------------------+
| go.etcd.io/etcd                   | CVE-2018-1098    | HIGH     | 0.0.0-20191023171146-3cf2f69b5738 | 3.4.0                                | etcd: Cross-site request forgery      |
|                                   |                  |          |                                   |                                      | via crafted local POST forms          |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2018-1098  |
+                                   +------------------+----------+                                   +                                      +---------------------------------------+
|                                   | CVE-2018-1099    | MEDIUM   |                                   |                                      | etcd: DNS rebinding                   |
|                                   |                  |          |                                   |                                      | vulnerability in etcd server          |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2018-1099  |
+-----------------------------------+------------------+----------+-----------------------------------+--------------------------------------+---------------------------------------+
| golang.org/x/crypto               | CVE-2022-27191   | HIGH     | 0.0.0-20210921155107-089bfa567519 | 0.0.0-20220315160706-3147a52a75dd    | golang: crash in a                    |
|                                   |                  |          |                                   |                                      | golang.org/x/crypto/ssh server        |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2022-27191 |
+-----------------------------------+------------------+----------+-----------------------------------+--------------------------------------+---------------------------------------+
| gopkg.in/yaml.v2                  | CVE-2019-11254   | MEDIUM   | 2.2.2                             | 2.2.8                                | kubernetes: Denial of                 |
|                                   |                  |          |                                   |                                      | service in API server via             |
|                                   |                  |          |                                   |                                      | crafted YAML payloads by...           |
|                                   |                  |          |                                   |                                      | -->avd.aquasec.com/nvd/cve-2019-11254 |
+                                   +------------------+----------+                                   +--------------------------------------+---------------------------------------+
|                                   | GMS-2019-2       | UNKNOWN  |                                   | v2.2.3                               | XML Entity Expansion                  |
+                                   +------------------+          +                                   +--------------------------------------+---------------------------------------+
|                                   | GO-2021-0061     |          |                                   | 2.2.3                                |                                       |
+-----------------------------------+------------------+----------+-----------------------------------+--------------------------------------+---------------------------------------+

[ZyanKLee]

Thanks, that's at least helpful for the next steps.

So no matter if we keep the vendor folder or remove it, there are several deps that need updating and at least one where no fixed version exists and we should think about replacing.

[ZyanKLee]

Due to a suspected security breach of the update server and code repository, there's
been a concerted effort by the NoiseTorch community to ensure the source code and
binaries are free from malicious code.

No malicious code has been found.

You can read more about the audit that was done here
and here.
Updates will now be retrieved from the project's releases page to avoid any risk
of this reoccurring. We thank everyone for their trust and the love that they've
shown towards the project in this unpleasant time.