Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 30 Mar 2024 17:17:38 +0100
From: Jonathan Schleifer <>
To: "Rein Fernhout (Levitating)" <>,
Subject: Re: Re: backdoor in upstream xz/liblzma leading to ssh
 server compromise

Am 30.03.24 um 16:10 schrieb Rein Fernhout (Levitating):

> The script attached by Andres was from 5.6.0.
> I extracted the script from both versions and I can verify your diff.
> I attached the two versions I extracted.
> It definitely does look like the 5.6.1 version looks for 2 extra scripts 
> to execute.
> I don't get any matches on the greps either though.

My main worry is that when I extracted it, I replaced the sed in here:

sed \"r\n\" $gl_am_configmake | eval $gl_path_map | $gl_localedir_prefix 
-d 2>/dev/null

With a simple cat, as I could not make sed work. This worries me as it 
means there is probably some other transformation that I'm missing that 
would have made the sed work. Which means there's transformations I'm 
missing and those could as well mutate some of the test files or 
resulting payloads. So it could either change the grep itself, or create 
files that match the grep.

Which means I'm not sure that actually no files match and it actually 
executes nothing.

> I also want to look more into the object file.

I think it's time to coordinate things.

I created a chat room for this on Matrix, IRC and Discord -- all bridged 
together so it's essentially one chat room. Those interested, please join:

IRC: #xz-backdoor-reversing on


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.