Re: backdoor in upstream xz/liblzma leading to ssh server compromise

["Alexander E. Patrakov" <patrakov () gmail com>]

On Sat, Mar 30, 2024 at 12:09 AM Andres Freund <andres () anarazel de> wrote:
> == Affected Systems ==
>
> The attached de-obfuscated script is invoked first after configure, where it
> decides whether to modify the build process to inject the code.
>
> These conditions include...
<snip>
> Running as part of a debian or RPM package build:
>     if test -f "$srcdir/debian/rules" || test "x$RPM_ARCH" = "xx86_64";then

Could you please confirm that the Arch Linux binary package was never
actually compromised?

> openssh does not directly use liblzma. However debian and several other
> distributions patch openssh to support systemd notification, and libsystemd
> does depend on lzma.

<snip>

> Observed requirements for the exploit:
> b) argv[0] needs to be /usr/sbin/sshd

I have checked, and found that Arch Linux does not apply any patches
when building OpenSSH.

P.S. in the detect.sh script, the "set -eu" line plays a bad trick: it
aborts the check if sshd is not actually linked to liblzma.

-- 
Alexander E. Patrakov