A backdoor is believed to have been introduced in the xz package by developer Jia Tan, who became a maintainer in 2022 and started releasing versions from 5.4.2 onwards. In addition to the xz project, the alleged author of the backdoor also contributed to the development of the xz-java and xz-embedded packages and was included among the maintainers of the XZ Embedded project used in the Linux kernel.
Two more participants have also been noticed in promoting the backdoor â Jigar Kumar and Hans Jansen, who appear to be virtual personas. In April 2022, Jigar Kumar facilitated the acceptance of early patches from Jia Tan in xz, which implemented support for string filters, and exerted moral pressure on Lasse Collin, the then maintainer, criticizing him for being incapable of performing his duties and not accepting useful patches. In June, Lasse Collin agreed that the project needed a new maintainer, lamented burnout and mental health issues, and handed over maintainer rights to Jia Tan. After that, Jigar Kumar no longer appeared in the mailing list.
After receiving maintainer rights, Jia Tan actively began adding changes to the project and statistically ranked second among developers for the number of changes over two years. In March 2023, the person responsible for testing the xz package in the oss-fuzz service was replaced from Lasse Collin to Jia Tan, and in June, changes were accepted into xz that added support for the IFUNC mechanism in liblzma (the crc64_fast constructor was replaced with ifunc), which was later used to organize function interception in the backdoor. The change was proposed by Hans Jansen, and Jia Tan accepted it into xz. The Hans Jansen account was created just before the pull request was submitted.
In July 2023, Jia Tan sent a request to the oss-fuzz developers to disable ifunc checking due to its incompatibility with the "-fsanitize=address" mode. In early February 2024, the link to the project site in oss-fuzz and on the main page of tukaani.org was changed from "tukaani.org/xz/" to "xz.tukaani.org", where the subdomain "xz.tukaani.org" was hosted on GitHub Pages and personally controlled by Jia Tan. On February 23, archives for testing the decoder's operation were placed in the xz repository, including files bad-3-corrupt_lzma2.xz and good-large_compressed.lzma containing a hidden backdoor. M4 macros to activate the backdoor were included only in the tar archive with release 5.6.0 and were excluded from the Git repository, but they were exposed in the .gitignore file.
On March 17, Hans Jansen, who previously developed patches with IFUNC support, was registered as a participant in the Debian project, and on March 25, he submitted a request to update the xz-utils package version in the Debian repository. Update requests were also sent to the Fedora and Ubuntu developers (in Ubuntu, the repository was in a freeze state and the change was rejected).
Some users also joined the requests to update the xz version, claiming that the new version fixed interfering crashes detected during debugging in valgrind (the issues arose from incorrect stack layout detection in the backdoor handler, and the backdoor developers attempted to address these problems in xz version 5.6.1). The crash also caught the attention of Andres Freund, a Microsoft employee involved in PostgreSQL development, who discovered the presence of the backdoor and notified the community.
Source: opennet.ru
