[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAOp4FwTiyuHZ9HGBzTx35gahFbkrTpjrm1oUPVWp8VAoQhSC1w@mail.gmail.com>
Date: Sat, 30 Mar 2024 23:03:05 +0400
From: Loganaden Velvindron <loganaden@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: backdoor in upstream xz/liblzma leading to ssh
server compromise
A look at systemd does show dlopen() to libarchive.
Perhaps it was supposed to be another point of entry.
On Sat, Mar 30, 2024, 20:44 Tavis Ormandy <taviso@...il.com> wrote:
> On 2024-03-29, Ivan Delalande wrote:
> > On Fri, Mar 29, 2024 at 08:51:26AM -0700, Andres Freund wrote:
> >> For which the exploit code was then adjusted:
> >>
> https://github.com/tukaani-project/xz/commit/6e636819e8f070330d835fce46289a3ff72a7b89
> >>
> >> Given the activity over several weeks, the committer is either directly
> >> involved or there was some quite severe compromise of their
> >> system. Unfortunately the latter looks like the less likely
> explanation, given
> >> they communicated on various lists about the "fixes" mentioned above.
> >
> > Knowing this, I hope the recent kernel patch series involving the same
> > person to some degree will get extra scrutiny:
> >
> https://lore.kernel.org/lkml/20240320183846.19475-1-lasse.collin@tukaani.org/t/
> >
> > Thanks Andres, incredible find and write-up!
> >
>
> It was also pointed out they submitted an odd PR to libarchive:
>
> https://github.com/libarchive/libarchive/pull/1609
>
> In summary, they replaced calls to safe_fprintf() with fprintf() --
> meaning control characters are no longer filtered from errors. That
> seems pretty minor, but now that we know they were in the business of
> obfuscating the presence of backdoors -- seems a bit suspicious.
>
> Regardless, that change has now been reverted:
>
> https://github.com/libarchive/libarchive/pull/2101
>
> Tavis.
>
> --
> _o) $ lynx lock.cmpxchg8b.com
> /\\ _o) _o) $ finger taviso@....org
> _\_V _( ) _( ) @taviso
>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
