Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 30 Mar 2024 02:59:14 +0800
From: "Alexander E. Patrakov" <>
Subject: Re: backdoor in upstream xz/liblzma leading to ssh
 server compromise

On Sat, Mar 30, 2024 at 12:09 AM Andres Freund <> wrote:
> == Affected Systems ==
> The attached de-obfuscated script is invoked first after configure, where it
> decides whether to modify the build process to inject the code.
> These conditions include...
> Running as part of a debian or RPM package build:
>     if test -f "$srcdir/debian/rules" || test "x$RPM_ARCH" = "xx86_64";then

Could you please confirm that the Arch Linux binary package was never
actually compromised?

> openssh does not directly use liblzma. However debian and several other
> distributions patch openssh to support systemd notification, and libsystemd
> does depend on lzma.


> Observed requirements for the exploit:
> b) argv[0] needs to be /usr/sbin/sshd

I have checked, and found that Arch Linux does not apply any patches
when building OpenSSH.

P.S. in the script, the "set -eu" line plays a bad trick: it
aborts the check if sshd is not actually linked to liblzma.

Alexander E. Patrakov

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.