Report feedback

a backdoor exploitable in combination with the OpenSSH SSH server is present in the official source code distribution packages of the xz compression tool, which includes the liblzma library, in versions 5.6.0 and 5.6.1. The versions are relatively new - 5.6.0 was released on 24.02.2024 [1] and 5.6.1 on 09.03.2024 [2] - so they are not yet very widespread. The affected distributions are Debian Sid (testing), which has already reverted to 5.4.5 as part of DSA 5649-1 [3], Fedora (40 and 41/Rawhide), where a fix and a warning have been issued [4], and further Arch, Gentoo, Slackware-current, NixOS testing, Alpine Edge and others - the most complete list so far is on the blog [5], including the information that the backdoor affects only AMD64 systems and requires the use of glibc (other implementations do not support indirect functions IFUNC [6]). A complete analysis was published by Andres Freund on the oss-security forum [7], where a discussion on the scope and impact subsequently started. The analysis [7] also contains the deobfuscated code and it follows from it that the backdoor uses stealth techniques and so currently only sshd binaries - the OpenSSH server - are affected, which, however, is not linked against liblzma by default, which e.g. Debian and Fedora change. The backdoor also checks for running in a terminal, in a debugger, or the use of LD_PRELOAD, in which cases it does not activate; details are in [7]. An issue was opened on the project's GitHub [8], where the intent of the authors is discussed - this is, however, now hard to dispute, e.g. version 5.6.1 [2] disguises the extension of the backdoor's functionality as a bug fix. Recommendation: Check the xz and liblzma version in use: $ xz --version If the version is 5.6.0 or 5.6.1, downgrade to an older version, e.g. the last stable 5.4.6 [9], and check the machine for infection. If an OpenSSH server exposed to the Internet is also running on the machine, consider the machine compromised.