Re: xz backdoor

[jbranso]

April 1, 2024 at 3:46 PM, "Reza Housseini" <reza.housseini@gmail.com> wrote:



> 
> Hi Guixers
> 
> Just stumbled upon this recently discovered supply chain attack on xz, 
> 
> inserting a backdoor via test files [1, 2]. And it made me wondering, 
> 
> what would have been the effects on guix and how can we potentially 
> 
> avoid it?

It looks like the affected version is XZ XZ 5.6.0/5.6.1, and guix is
currently on 5.2.8.  The git repo is apparently not affected.  So we
could use the git repo and not the tarball.  Also it mainly seems to 
target systemd.  I'm basically reading phoronix's coverage:



The malicious injection present in the xz versions 5.6.0 and 5.6.1
libraries is obfuscated and only included in full in the download package
- the Git distribution lacks the M4 macro that triggers the build 
of the malicious code. The second-stage artifacts are present in 
the Git repository for the injection during the build time, in 
case the malicious M4 macro is present.

The resulting malicious build interferes with authentication in sshd via 
systemd. SSH is a commonly used protocol for connecting remotely to systems, 
and sshd is the service that allows access. Under the right circumstances this 
interference could potentially enable a malicious actor to break sshd 
authentication and gain unauthorized access to the entire system remotely.

Joshua

P.S. Here's guix's xz source code:

https://git.savannah.gnu.org/cgit/guix.git/tree/gnu/packages/compression.scm#n494

And the phoronix link:

https://www.phoronix.com/news/XZ-CVE-2024-3094

> 
> Stay safe!
> 
> Reza
> 
> [1] https://www.openwall.com/lists/oss-security/2024/03/29/4
> 
> [2] https://access.redhat.com/security/cve/cve-2024-3094#cve-cvss-v3
>