MESSAGE
| DATE | 2024-04-25 |
| FROM | Ruben Safir
|
| SUBJECT | Subject: [Hangout - NYLXS] xz backdoor
|
https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27
FAQ on the xz-utils backdoor (CVE-2024-3094)
This is a living document. Everything in this document is made in good
faith of being accurate, but like I just said; we don't yet know
everything about what's going on.
Background
On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of
software that gives developers lossless compression. This package is
commonly used for compressing release tarballs, software packages,
kernel images, and initramfs images. It is very widely distributed,
statistically your average Linux or macOS system will have it installed
for convenience.
This backdoor is very indirect and only shows up when a few known
specific criteria are met. Others may be yet discovered! However, this
backdoor is at least triggerable by remote unprivileged systems
connecting to public SSH ports. This has been seen in the wild where it
gets activated by connections - resulting in performance issues, but we
do not know yet what is required to bypass authentication (etc) with it.
We're reasonably sure the following things need to be true for your
system to be vulnerable:
You need to be running a distro that uses glibc (for IFUNC)
You need to have versions 5.6.0 or 5.6.1 of xz or liblzma installed
(xz-utils provides the library liblzma) - likely only true if running a
rolling-release distro and updating religiously.
We know that the combination of systemd and patched openssh are
vulnerable but pending further analysis of the payload, we cannot be
certain that other configurations aren't.
While not scaremongering, it is important to be clear that at this
stage, we got lucky, and there may well be other effects of the infected
liblzma.
If you're running a publicly accessible sshd, then you are - as a rule
of thumb for those not wanting to read the rest here - likely vulnerable.
If you aren't, it is unknown for now, but you should update as quickly
as possible because investigations are continuing.
TL:DR:
Using a .deb or .rpm based distro with glibc and xz-5.6.0 or xz-5.6.1:
Using systemd on publicly accessible ssh: update RIGHT NOW NOW NOW
Otherwise: update RIGHT NOW NOW but prioritize the former
Using another type of distribution:
With glibc and xz-5.6.0 or xz-5.6.1: update RIGHT NOW, but
prioritize the above.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
You are right that he did attack the makefile but the makefile is for
the addition of xz to standard opensshd for deb and rpms
I don't use debs or rpms
--
So many immigrant groups have swept through our town
that Brooklyn, like Atlantis, reaches mythological
proportions in the mind of the world - RI Safir 1998
http://www.mrbrklyn.com
DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002
http://www.nylxs.com - Leadership Development in Free Software
http://www.brooklyn-living.com
Being so tracked is for FARM ANIMALS and extermination camps,
but incompatible with living as a free human being. -RI Safir 2013
_______________________________________________
Hangout mailing list
Hangout-at-nylxs.com
http://lists.mrbrklyn.com/mailman/listinfo/hangout
|
|
