no ublue image ever shipped this, it affected F41/rawhide, and a couple (less?) builds of f40
no ublue image ever shipped this, it affected F41/rawhide, and a couple (less?) builds of f40
JI've stayed awake all night tracking this
YThat’s what worried me. I saw news of this.
Kwe're still all f39, only recently got f40 building on main
YOooooooh
YI thought we hit 40
JF40 had a version with the payload, but had it disabled
ZThis is from my Bazzite install:
We're on a way older version than the version that was affected
We're on a way older version than the version that was affected
JThats why 5.6.1 exists
YWhat is that package for anyway?
JValgrind threw an error
Kamazing it's xz of all things, that's a heavily used package
ZCompression algorhitms
YOh
YFor archives?
ZYea
JThats one use case
ZFor example when you see a "tar.xz" package or similar
ZBut afaik it's also used within, SSH in some way, maybe compressing and sending the key chain? Unsure, it's a low level package that most users never end up realising of
JNope
JIts not
AImagine how many of those windows has
ABut we don't know about them bc closed source
ZThat's definitely spooky
ZAnd ever since maining my steam deck and building my own router from scratch with OpenWRT it's made me a lot more aware of the stuff
ZIn my definition of "low level" I don't exactly mean the base linux packages but rather a base package nearly all linux distros have that's not interfaced or used by most "average users"
Jokay so
ZCould've definitely used a better wording but if you have examples and explanations of how the package is used and in what extend I'd love to hear it
Jssh does not use xz
Jbut the xz backdoor only hijacks ssh
Jso how does it do it?
JSome linux distros (such as Fedora and Debian) patch ssh to link against libsystemd-notify to enable it to send systemd notifications and interact with other components
libsystemd-notify then links against xz and other libraries
libsystemd-notify then links against xz and other libraries
ZSo what's actually happening in connection with the xz package and the SSH connection?
JSSH relies on OpenSSH for a lot of things
Jand xz sets up some redirections to hijack the execution path and does its own thing
Jthe full extend of what it does is not yet known, but it does add its own keys to be accepted
ZAh, so xz wasn't actually something in use with SSH at all but rather added code that used the systemd-notify to know when to execute that separate code?
Jno, it was in use with ssh
Jxz relies on ssh linking against systemd-notify to get into the sshd process
Jand then it modifies openssh at runtime to add its own things
Jthe backdoor explicitly only targets
/usr/sbin/sshdJaka the ssh server
ZYes but what does xz and SSH do to work together originally?
Jssh does not use xz
ZRight so no original connection with each other before the malicious update?
Jor after
Jthe connection is made by distros that modify ssh
Jmainly debian and fedora
ZDebian and Fedora modifies SSH?
Jyes
