Are we safe from this? I’m not sure how to check https://www.gamingonlinux.com/2024/03/xz-tools-and-

Are we safe from this? I’m not sure how to check https://www.gamingonlinux.com/2024/03/xz-tools-and-libraries-compromised-with-a-critical-issue/

GamingOnLinux

XZ tools and libraries compromised with a critical issue

There's been an urgent security bulletin sent out in a few places today in the Linux sphere that relates to the XZ tools and libraries with liblzma, as certain version have been compromised.

Jan•3/30/24, 3:59 PM

yes

Jan•3/30/24, 3:59 PM

we are

YasukeOP•3/30/24, 3:59 PM

So as long as I update I’m good?

Jan•3/30/24, 4:00 PM

Dont even need to update

Jan•3/30/24, 4:00 PM

Bazzite never had it

YasukeOP•3/30/24, 4:00 PM

Nice

YasukeOP•3/30/24, 4:00 PM

Glad it’s my distro of choice now

Jan•3/30/24, 4:01 PM

If you have any questions regarding that situation feel free to ask

YYasuke Are we safe from this? I’m not sure how to check https://www.gamingonlinux.com/2...

Kyle Gospo•3/30/24, 4:01 PM

no ublue image ever shipped this, it affected F41/rawhide, and a couple (less?) builds of f40

Jan•3/30/24, 4:01 PM

I've stayed awake all night tracking this

KKyle Gospo no ublue image ever shipped this, it affected F41/rawhide, and a couple (less?) ...

YasukeOP•3/30/24, 4:01 PM

That’s what worried me. I saw news of this.

Kyle Gospo•3/30/24, 4:01 PM

we're still all f39, only recently got f40 building on main

YasukeOP•3/30/24, 4:02 PM

Oooooooh

YasukeOP•3/30/24, 4:02 PM

I thought we hit 40

KKyle Gospo no ublue image ever shipped this, it affected F41/rawhide, and a couple (less?) ...

Jan•3/30/24, 4:02 PM

F40 had a version with the payload, but had it disabled

Zelaf•3/30/24, 4:02 PM

This is from my Bazzite install:

$ xz -V
xz (XZ Utils) 5.4.4
liblzma 5.4.4

$ xz -V
xz (XZ Utils) 5.4.4
liblzma 5.4.4

We're on a way older version than the version that was affected

Jan•3/30/24, 4:02 PM

Thats why 5.6.1 exists

YasukeOP•3/30/24, 4:02 PM

What is that package for anyway?

Jan•3/30/24, 4:02 PM

Valgrind threw an error

Kyle Gospo•3/30/24, 4:02 PM

amazing it's xz of all things, that's a heavily used package

Zelaf•3/30/24, 4:02 PM

Compression algorhitms

YasukeOP•3/30/24, 4:02 PM

YasukeOP•3/30/24, 4:03 PM

For archives?

Zelaf•3/30/24, 4:03 PM

Yea

Jan•3/30/24, 4:03 PM

Thats one use case

Zelaf•3/30/24, 4:03 PM

For example when you see a "tar.xz" package or similar

Zelaf•3/30/24, 4:04 PM

But afaik it's also used within, SSH in some way, maybe compressing and sending the key chain? Unsure, it's a low level package that most users never end up realising of

Jan•3/30/24, 4:04 PM

Nope

Jan•3/30/24, 4:04 PM

Its not

antheas•3/30/24, 4:04 PM

Imagine how many of those windows has

antheas•3/30/24, 4:04 PM

But we don't know about them bc closed source

Zelaf•3/30/24, 4:05 PM

That's definitely spooky

Zelaf•3/30/24, 4:05 PM

And ever since maining my steam deck and building my own router from scratch with OpenWRT it's made me a lot more aware of the stuff

JJan Its not

Jan•3/30/24, 4:05 PM

Ginme a minute to finish my Turkey sandwich and I'll explain

JJan Ginme a minute to finish my Turkey sandwich and I'll explain

Zelaf•3/30/24, 4:06 PM

In my definition of "low level" I don't exactly mean the base linux packages but rather a base package nearly all linux distros have that's not interfaced or used by most "average users"

Jan•3/30/24, 4:07 PM

okay so

Zelaf•3/30/24, 4:07 PM

Could've definitely used a better wording but if you have examples and explanations of how the package is used and in what extend I'd love to hear it

Jan•3/30/24, 4:07 PM

ssh does not use xz

Jan•3/30/24, 4:07 PM

but the xz backdoor only hijacks ssh

Jan•3/30/24, 4:07 PM

so how does it do it?

Jan•3/30/24, 4:08 PM

Some linux distros (such as Fedora and Debian) patch ssh to link against libsystemd-notify to enable it to send systemd notifications and interact with other components
libsystemd-notify then links against xz and other libraries

Zelaf•3/30/24, 4:08 PM

So what's actually happening in connection with the xz package and the SSH connection?

Jan•3/30/24, 4:09 PM

SSH relies on OpenSSH for a lot of things

Jan•3/30/24, 4:09 PM

and xz sets up some redirections to hijack the execution path and does its own thing

Jan•3/30/24, 4:09 PM

the full extend of what it does is not yet known, but it does add its own keys to be accepted

Zelaf•3/30/24, 4:10 PM

Ah, so xz wasn't actually something in use with SSH at all but rather added code that used the systemd-notify to know when to execute that separate code?

Jan•3/30/24, 4:10 PM

no, it was in use with ssh

Jan•3/30/24, 4:10 PM

xz relies on ssh linking against systemd-notify to get into the sshd process

Jan•3/30/24, 4:11 PM

and then it modifies openssh at runtime to add its own things

Jan•3/30/24, 4:11 PM

the backdoor explicitly only targets /usr/sbin/sshd/usr/sbin/sshd

Are we safe from this? I’m not sure how to check https://www.gamingonlinux.com/2024/03/xz-tools-and-

Similar Threads

Similar Threads

Similar Threads