Re: backdoor in upstream xz/liblzma leading to ssh server compromise

[Matthias Weckbecker <matthias () weckbecker name>]

On Fri, Mar 29, 2024 at 12:19:26PM -0700, Andres Freund wrote:
> Hi,

Hi Andres,

> On 2024-03-29 19:44:05 +0100, Matthias Weckbecker wrote:
> > I've attached a yara rule to detect the *.o droplet you attached in the
> > email (liblzma_la-crc64-fast.o.gz).
>
> Unfortunately xz 5.61 added further obfuscations, making it harder to
> detect. Should have made it clearer that the attached .o was from 5.60. Among
> others 5.61 removed the two symbols you're checking against here.  That's why
> Vegard's script looks for a specific instructions sequence, but obviously is
> also more obscure :/

Yes, all correct. For this you'll have to match characteristic sequences
of instructions. I've attached a yara rule for this as well.

> Regards,
>
> Andres

Thanks,
Matthias

Attachment: CVE-2024-3094-p.yara
Description: