Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 29 Mar 2024 19:04:59 -0700
From: Andres Freund <>
Cc: Solar Designer <>
Subject: Re: backdoor in upstream xz/liblzma leading to ssh
 server compromise


On 2024-03-30 01:08:22 +0100, Rein Fernhout (Levitating) wrote:
> > Andres, maybe you (or Florian or someone else) can post the .o file from
> > 5.61 as well (gzipped just like the previous one, please)?
> I think the attached liblzma_la-crc64-fast.o is taken from 5.6.1.
> I compiled 5.6.1 and ended up with a nearly identical object file.

I don't think so - while it was extracted by Florian, not me, I just
re-extracted it from 5.6.0 and got the same result.

> When I compiled 5.6.0 I got a larger object file with additional symbols
> crc64_generic, crc64_arch_optimized and crc64_resolve.

I think it may just be confusion from the script renaming files. The symbols
you mention come from the script compiling src/liblzma/check/crc64_fast.c
after making some small changes, to call into the added _get_cpuid().  Whereas
the attached file was the .o file that was, in very obfuscated form, committed
to the repository.

The script is quite sneaky, it

1) extracts ./liblzma_la-crc64-fast.o from the archive
2) copies .libs/liblzma_la-crc64_fast.o .libs/liblzma_la-crc64-fast.o (note
   the .libs)
3) compiles and links the modified crc64_fast.c file together with the
   extracted ./liblzma_la-crc64-fast.o, outputting to
   .libs/liblzma_la-crc64_fast.o, using -r
4) does 2) for the 32 bit version
5) compiles the modified crc32_fast.c, outputting to
6) links the shared library
7) if compilation fails, it moves .libs/liblzma_la-crc{64,32}-fast.o back to
   their original name, I guess to removing "evidence" of the modified output
8) removes

If you found crc64_generic etc in liblzma_la-crc64-fast.o, you must have used
the one from .libs/ somehow?

I'm attaching ./liblzma_la-crc64-fast.o for both 5.6.0 and 5.6.1. These are
the files extracted from the .xz file, and should not have symbols for
crc64_arch_optimized, crc64_resolve, crc64_generic but will have stuff like
_get_cpuid, .crc64_generia.

When the backdoor is not active .libs/liblzma_la-crc64_fast.o has only few
symbols, crc64_generic, crc64_arch_optimized, crc64_resolve.


Andres Freund

Download attachment "liblzma_la-crc64-fast-5.6.0.o.gz" of type "application/gzip" (36493 bytes)

Download attachment "liblzma_la-crc64-fast-5.6.1.o.gz" of type "application/gzip" (36517 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.