Backdoor in upstream xz/liblzma leading to SSH server compromise (openwall.com)

Article summary

A backdoor was discovered in the xz/liblzma package, which can lead to SSH server compromise. The backdoor is present in the distributed tarballs for versions 5.6.0 and 5.6.1 and was likely introduced by a compromised upstream repository. The exploit can be triggered when logging in via SSH, causing a slowdown, and potentially allowing unauthorized access. The issue is believed to affect Linux systems running certain patches, but not macOS or BSD.

Main themes

• xz/liblzma backdoor
• SSH server compromise
• Linux security
• Open-source software vulnerabilities
• Supply chain attacks

What commenters say

• The backdoor's complexity suggests it may be the work of a state-sponsored attacker, potentially from China, due to the contributor's name and the nature of the exploit.
• Disabling ifunc can prevent the backdoor from working, but this may not be a viable solution for all systems, and the trade-offs between security and performance need to be considered.
• The use of ifunc in GNU libc can provide performance benefits, but it also introduces security risks, and alternative approaches, such as compiling software for the target machine, may be more secure.
• The attack highlights the importance of verifying the integrity of open-source software and the need for improved workflows to detect and prevent similar vulnerabilities in the future.
• Some contributors may be required by law to add vulnerabilities to software in certain countries, which raises concerns about the security of global software supply chains.
• The true identity and motivations of the attacker are unknown, and it is possible that the Chinese name is a red herring, intended to mislead investigators.