scy
Eek. Apparently liblzma (part of the xz package) has a backdoor in versions 5.6.0 and 5.6.1, causing SSH to be compromised.
https://www.openwall.com/lists/oss-security/2024/03/29/4
This might even have been done on purpose by the upstream devs.
Developing story, please take with a grain of salt.
The 5.6 versions are somewhat recent, depending on how bleeding edge your distro is you might not be affected.
Easy
@scy The user (or whoever was behind that account) was seemingly also pretty active in other projects. The next couple of days are gonna be "interesting"... 😬
scy
Red Hatter rwmj on https://news.ycombinator.com/item?id=39866275:
> the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features". We even worked with him to fix the valgrind issue (which it turns out now was caused by the backdoor […]
> He has been part of the xz project for 2 years, adding all sorts of binary test files
> with this level of sophistication I would be suspicious of even older versions of xz
scy
Red Hat released an urgent security alert for Fedora 41 and Rawhide users:
> PLEASE IMMEDIATELY STOP USAGE OF ANY FEDORA 41 OR FEDORA RAWHIDE INSTANCES for work or personal activity.
https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
> Although Fedora 40 beta contained the 5.6 version of xz in an update, the build environment prevents the injection from correctly occurring, and has not been shown to be compromised. Fedora 40 has now reverted to the 5.4.x versions of xz.
scy
Hell yeah #GitHub, that's certainly going to help the researchers who are working on the weekend trying to reverse engineer the #xz backdoor.
What a great idea. 🙄
Edit: This also deleted the project's GitHub-hosted website.
Mirrors of the repo can be found here:
https://hachyderm.io/@joeyh/112181981560074232
https://git.tukaani.org/?p=xz.git;a=summary
scy
Meanwhile, #Debian is considering rolling #xz back not only to the point before the backdoor was added, but to where the person who _wrote_ the backdoor hadn't contributed any code to xz yet.
Which means considering creating patches to fix ABI breakage such a rollback would cause.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024
For all the trash talk Debian gets for being "pedantic" and slow to change: They put in the _work_ to do things _right_. I respect that.
via https://hachyderm.io/@joeyh/112181512951127467
(Edit: English is hard.)
scy
I'm not saying that it looks like someone has specifically targeted xz and played the long game by helping out a maintainer that was overworked and suffered from mental health issues
but it does look like someone has specifically targeted xz and played the long game by helping out a maintainer that was overworked and suffered from mental health issues
scy
Ugh, there is xz code in the #Linux kernel.
An open patchset from a few days ago has been put on hold.
https://lore.kernel.org/lkml/202403291221.124220E0F4@keescook/
scy
There is now a GitHub issue in the xz repository inquiring about whether this has been intentional or not.
scy
Also, PSA for people who are immediately triggered by the word "systemd", partially blaming it for the issue:
No.
Some distros patch OpenSSH to link to libsystemd to call https://www.freedesktop.org/software/systemd/man/latest/sd_notify.html to notify systemd about startup completion.
libsystemd then links to the backdoored lzma for other things.
But OpenSSH could've implemented the notification on its own. It's literally "send a line into a socket", only a few lines of code, even in C.
https://chaos.social/@smrqdt/112180465514002100
https://news.ycombinator.com/item?id=39866076
scy
_Please_ do not advise people to run `xz --version` or similar to check whether they're affected or not.
Right now, as far as I know, the analysis of the obfuscated malware is far from complete. There may be other triggers. There may be malware in older versions, because the attacker had commit access for years.
By running xz and asking it for its version, you're _running_ what could be more malware.
Instead, ask the system's package manager which version of xz is currently installed.
scy
By the way, Debian keeps a copy of every package it has built, and the corresponding source code.
Which comes in _really_ handy if GitHub, you know, decides to just nuke upstream from orbit.
(This archive is currently a three-figure number of terabytes in size.)
scy
Apparently the main #xz maintainer, Lasse Collin (Larhzu), who was assumed to have simply been offline for the past 24 hours, has now started working on a post-mortem overview page of the incident.
https://tukaani.org/xz-backdoor/
> This page is short for now but it will get updated as I learn more about the incident. Most likely it will be during the first week of April 2024.
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.