Looks like someone managed to get a backdoor into ssh in Fedora and Debian testing. Patch systems ASAP.

https://www.openwall.com/lists/oss-security/2024/03/29/4

Reply to this note

Please Login to reply.

Discussion

ouch!

Wow:

"That line is *not* in the upstream source of build-to-host, nor is

build-to-host used by xz in git. However, it is present in the tarballs

released upstream, except for the "source code" links, which I think github"

They pwned the release distribution; source in git is fine.

Nuts.

Source in git has the malicious binary, though. A malicious committer did it, not just anyone.

Fascinated to behold. 🍿

the source apparently does include some code that the exploit needs for it to work

Wouldn’t happen in the BSDs 😏

Technically, the backdoor is in xz-utils, and affects sshd when it is linked into sshd at runtime, as happens in most Linux distributions. The backdoor could conceivably be designed to affect other programs in addition to sshd. (Of course, affecting sshd is bad enough).

It's a pretty sophisticated "supply chain" attack. Sadly, the upstream xz-utils project maintainer is either complicit or compromised.

nostr:note1mqvnsk7me3wt3xd2pqyu04chlvygdphkt5p8sm56wxa28agxtc5stt2l5q

lmao

Mans been busy, going to need to check their commit history...

Impressive how this was caught within three weeks of the first malicious commit.

Honestly that’s mostly cause the exploit was kinda shitty, though…

*) by chance

Because it added a 0.4 second delay on ssh logins and someone decided to have a look.