Re: backdoor in upstream xz/liblzma leading to ssh server compromise

[Vegard Nossum <vegard.nossum () oracle com>]

On 29/03/2024 19:54, Ivan Delalande wrote:
> On Fri, Mar 29, 2024 at 08:51:26AM -0700, Andres Freund wrote:
> > For which the exploit code was then adjusted:
> > https://github.com/tukaani-project/xz/commit/6e636819e8f070330d835fce46289a3ff72a7b89
> >
> > Given the activity over several weeks, the committer is either directly
> > involved or there was some quite severe compromise of their
> > system. Unfortunately the latter looks like the less likely explanation, given
> > they communicated on various lists about the "fixes" mentioned above.
> Knowing this, I hope the recent kernel patch series involving the same
> person to some degree will get extra scrutiny:
> https://lore.kernel.org/lkml/20240320183846.19475-1-lasse.collin () tukaani org/t/

I *think* this patch series is safe and was just pushed to make more
people upgrade to newer versions faster (you'll notice the BCJ filters
are Co-developed-by: Jia -- not implying that Lasse was acting in bad
faith here).

Of course it still deserves more scrutiny...


Vegard