Arch Linux

7761 readers

25 users here now

The beloved lightweight distro

founded 4 years ago

MODERATORS

k_o_t@lemmy.ml

367

The xz package has been backdoored, you need to update your system now (archlinux.org)

submitted 7 months ago by Fubarberry@sopuli.xyz to c/archlinux@lemmy.ml

44 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] loudWaterEnjoyer@lemmy.dbzer0.com 29 points 7 months ago* (last edited 7 months ago) (2 children)

Well did I tell you guys, I use Debian stable btw

[–] SuperIce@lemmy.world 11 points 7 months ago (1 children)

To be fair, the backdoor only gets enabled when built as an RPM or Deb package, which doesn't apply to Arch Linux, and also requires openSSH to be linked to liblzma, which is also not the case on Arch. So from what we know so far, the Arch packages should not have had the vulnerability. The risk now is whether there are other vulnerabilities or backdoors that haven't been discovered which is why Arch made the update building directly from the git source instead of the known modified source tarball.

[–] DaTingGoBrrr@lemmy.ml 2 points 7 months ago* (last edited 7 months ago) (1 children)

According to this guy Debian is the problem https://lemmy.ml/comment/9780209

[–] Laser@feddit.de 29 points 7 months ago* (last edited 7 months ago) (3 children)

Debian is not really the problem, but rather the target, just read the original announcement at https://www.openwall.com/lists/oss-security/2024/03/29/4:

== Affected Systems ==
Running as part of a debian or RPM package build:
if test -f "$srcdir/debian/rules" || test "x$RPM_ARCH" = "xx86_64";then
...
openssh does not directly use liblzma. However debian and several other
distributions patch openssh to support systemd notification, and libsystemd
does depend on lzma.


Initially starting sshd outside of systemd did not show the slowdown, despite
the backdoor briefly getting invoked. This appears to be part of some
countermeasures to make analysis harder.

Observed requirements for the exploit:
a) TERM environment variable is not set
b) argv[0] needs to be /usr/sbin/sshd
c) LD_DEBUG, LD_PROFILE are not set
d) LANG needs to be set
e) Some debugging environments, like rr, appear to be detected. Plain gdb
   appears to be detected in some situations, but not others

So if you were using Arch, you were unaffected by this vulnerability because

the script wouldn't trigger because it uses neither DEB nor RPM packages
even if it had triggered, the backdoor only gets activated when the calling binary is /usr/sbin/sshdwhich doesn't happen in Arch because they don't patch OpenSSH to support systemd (which in turn pulls in xz).

This doesn't mean that Arch saved you because it's super secure or anything, but this was a supply chain attack that hit Arch (and Debian Sid, where the backdoor was actually caught because ssh logins took so long…), but it didn't trigger because it wasn't targeted.

Meaning there's no immediate need to be concerned, but you should update ASAP even though the Arch package probably doesn't contain backdoored artifacts.

[–] nifty@lemmy.world 2 points 7 months ago* (last edited 7 months ago) (1 children)

The announcement link leads to a Not Found

[–] Laser@feddit.de 1 points 7 months ago

It just worked fine when I checked right now

[–] meliodas_101@lemmy.world 1 points 7 months ago

Thanks for telling that means arch is not compromised as of right now.

[–] DaTingGoBrrr@lemmy.ml 1 points 7 months ago (1 children)

Thanks for clarifying. I read through the original announcement but I couldn't fully understand it