Re: backdoor in upstream xz/liblzma leading to ssh server compromise

["Rein Fernhout (Levitating)" <me () levitati ng>]

> P.S. in the detect.sh script, the "set -eu" line plays a bad trick: it
> aborts the check if sshd is not actually linked to liblzma.

Or if sshd is not in PATH. (/usr/sbin/)

On 2024-03-29 19:59, Alexander E. Patrakov wrote:
> On Sat, Mar 30, 2024 at 12:09 AM Andres Freund <andres () anarazel de> 
> wrote:
> > == Affected Systems ==
> >
> > The attached de-obfuscated script is invoked first after configure, 
> > where it
> > decides whether to modify the build process to inject the code.
> >
> > These conditions include...
> <snip>
> > Running as part of a debian or RPM package build:
> >     if test -f "$srcdir/debian/rules" || test "x$RPM_ARCH" = 
> > "xx86_64";then
>
> Could you please confirm that the Arch Linux binary package was never
> actually compromised?
>
> > openssh does not directly use liblzma. However debian and several 
> > other
> > distributions patch openssh to support systemd notification, and 
> > libsystemd
> > does depend on lzma.
>
> <snip>
>
> > Observed requirements for the exploit:
> > b) argv[0] needs to be /usr/sbin/sshd
>
> I have checked, and found that Arch Linux does not apply any patches
> when building OpenSSH.
>
> P.S. in the detect.sh script, the "set -eu" line plays a bad trick: it
> aborts the check if sshd is not actually linked to liblzma.