literature.cafe
  • Communities
  • Create Post
  • Create Community
  • heart
    Support Lemmy
  • search
    Search
  • Login
  • Sign Up
Atemu@lemmy.ml to Linux@lemmy.ml · 1 年前

backdoor in upstream xz/liblzma leading to ssh server compromise

www.openwall.com

external-link
message-square
98
link
fedilink
  • cross-posted to:
  • netsec@links.hackliberty.org
  • selfhosted@lemmy.world
  • linux@lemmy.world
  • programming@programming.dev
  • cybersecurity@sh.itjust.works
  • hackernews@lemmy.smeargle.fans
  • security@lemmy.ml
502
external-link

backdoor in upstream xz/liblzma leading to ssh server compromise

www.openwall.com

Atemu@lemmy.ml to Linux@lemmy.ml · 1 年前
message-square
98
link
fedilink
  • cross-posted to:
  • netsec@links.hackliberty.org
  • selfhosted@lemmy.world
  • linux@lemmy.world
  • programming@programming.dev
  • cybersecurity@sh.itjust.works
  • hackernews@lemmy.smeargle.fans
  • security@lemmy.ml
  • lemmyreader@lemmy.ml
    link
    fedilink
    English
    arrow-up
    18
    arrow-down
    1
    ·
    1 年前

    t y for sharing.

    #showerthoughts The problem is in upstream and has only entered Debian Sid/unstable. Does this mean that for example bleeding edge Arch (btw) sshd users are compromised already ?

    • Dima@lemmy.one
      link
      fedilink
      arrow-up
      27
      ·
      edit-2
      1 年前

      Looks like the 5.6.1-2 release on Arch moved from using the published GitHub releases to just using the git repository directly, which as I understand avoids the exploit (because the obfuscated script to inject the exploit is only present in the packaged tarballs and not the git repo itself)

      https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/commit/881385757abdc39d3cfea1c3e34ec09f637424ad

      • festus@lemmy.ca
        link
        fedilink
        English
        arrow-up
        33
        ·
        edit-2
        1 年前

        They also believe we (Arch users) are unaffected because this backdoor targeted Debian and Redhat type packaging specifically and also relied on a certain SSH configuration Arch doesn’t use. To be honest while it’s nice to know we’re unaffected, it’s not at all comforting that had the exploiter targeted Arch they would have succeeded. Just yesterday I was talking to someone about how much I love rolling release distros and now I’m feeling insecure about it.

        More details here: https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/issues/2

        • tal@lemmy.today
          link
          fedilink
          English
          arrow-up
          7
          ·
          1 年前

          Someone always has to be the guinea pig.

          That being said, maybe there’s an argument for distros that do rolling releases to have an “intentionally delayed rolling release” that just trails the regular rolling release by a fixed amount of time to provide more time for guinea pigs to run into things. If you want rolling, but can live with the delay, just use that.

          • Gobbel2000@feddit.de
            link
            fedilink
            arrow-up
            3
            ·
            1 年前

            OpenSuse Slowroll does pretty much that, a slightly delayed rolling release.

    • Atemu@lemmy.mlOP
      link
      fedilink
      arrow-up
      18
      ·
      edit-2
      1 年前

      Arch is on 5.6.1 as of now: https://archlinux.org/packages/core/x86_64/xz/

      We at Nixpkgs have barely evaded having it go to a channel used by users and we don’t seem to be affected by the backdoor.

      • Static_Rocket@lemmy.world
        link
        fedilink
        English
        arrow-up
        13
        ·
        edit-2
        1 年前

        Arch had a patch rolled out yesterday [1][2][3] that switches to the git repo. On top of that the logic in the runtime shim and build script modifier was orchestrated to target Debian and RPM build systems and environments [4].

        [1] https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/commit/881385757abdc39d3cfea1c3e34ec09f637424ad

        [2] https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/issues/2

        [3] https://security.archlinux.org/CVE-2024-3094

        [4] https://www.openwall.com/lists/oss-security/2024/03/29/4

    • blaise@champserver.net
      link
      fedilink
      arrow-up
      11
      ·
      1 年前

      The link mentions that it is only ran as part of a debian or RPM package build. Not to mention that on Arch sshd is not linked against liblzma anyways.

    • redcalcium@lemmy.institute
      link
      fedilink
      arrow-up
      9
      ·
      1 年前

      Arch has pushed the patched xz just a few hours ago: https://archlinux.org/news/the-xz-package-has-been-backdoored/

      • lemmyreader@lemmy.ml
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 年前

        Thanks a bunch.

    • Last@reddthat.com
      link
      fedilink
      arrow-up
      4
      ·
      1 年前

      deleted by creator

      • flying_sheep@lemmy.ml
        link
        fedilink
        arrow-up
        6
        arrow-down
        1
        ·
        1 年前

        Since you didn’t build a RPM or DEB package however, your didn’t compile in the backdoor.

        • Last@reddthat.com
          link
          fedilink
          arrow-up
          3
          ·
          1 年前

          deleted by creator

    • SMillerNL@lemmy.world
      link
      fedilink
      arrow-up
      4
      arrow-down
      1
      ·
      1 年前

      Homebrew rolled back the release after finding out

      • cantankerous_cashew@lemmy.world
        link
        fedilink
        arrow-up
        1
        ·
        1 年前

        Here’s a link to the PR for anyone who’s interested

Linux@lemmy.ml

linux@lemmy.ml

Subscribe from Remote Instance

Create a post
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !linux@lemmy.ml

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

  • Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
  • No misinformation
  • No NSFW content
  • No hate speech, bigotry, etc

Related Communities

  • !opensource@lemmy.ml
  • !libre_culture@lemmy.ml
  • !technology@lemmy.ml
  • !libre_hardware@lemmy.ml

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

Visibility: Public
globe

This community can be federated to other instances and be posted/commented in by their users.

  • 625 users / day
  • 3.07K users / week
  • 6.87K users / month
  • 17.2K users / 6 months
  • 31 local subscribers
  • 55.7K subscribers
  • 7.67K Posts
  • 187K Comments
  • Modlog
  • mods:
  • AgreeableLandscape@lemmy.ml
  • nooter692@lemmy.ml
  • MarcellusDrum@lemmy.ml
  • Arthur Besse@lemmy.ml
  • Cyclohexane@lemmy.ml
  • d3Xt3r@lemmy.nz
  • BE: 0.19.12
  • Modlog
  • Legal
  • Instances
  • Docs
  • Code
  • join-lemmy.org