this post was submitted on 31 Mar 2024
83 points (95.6% liked)

Explain Like I'm Five

14267 readers
43 users here now

Simplifying Complexity, One Answer at a Time!

Rules

  1. Be respectful and inclusive.
  2. No harassment, hate speech, or trolling.
  3. Engage in constructive discussions.
  4. Share relevant content.
  5. Follow guidelines and moderators' instructions.
  6. Use appropriate language and tone.
  7. Report violations.
  8. Foster a continuous learning environment.

founded 1 year ago
MODERATORS
sabbah@lemmy.world
AradFort@lemmy.world
rikudou@lemmings.world
Don_Dickle@lemmy.world
Rikudou_Sage@lemmy.world
83
ELI5: The Linux xz backdoor situation (pawb.social)
submitted 7 months ago by VinesNFluff@pawb.social to c/explainlikeimfive@lemmy.world
33 comments fedilink hide all child comments
 

PLEASE. I keep seeing it in memes. As I understand it the latest version of the xz package (present in rolling release distros like Arch and SUSE Tumbleweed) has "a backdoor", but I have no earthly clue what can be done by malicious folks with access to that backdoor or if I should be afraid or how to check if my distro is compromised or how to prevent damage if it is or (...)

you are viewing a single comment's thread
view the rest of the comments
[–] VinesNFluff@pawb.social 9 points 7 months ago* (last edited 7 months ago) (2 children)

I was on EndeavourOS (Arch-derived), but switched to SUSE Tumbleweed like, this weekend.

But hold up

So if the backdoor is all about exploiting ssh to gain full system access, and ssh was never enabled in my OS I'm in the clear regardless?

[–] ashaman2007@lemm.ee 8 points 7 months ago (2 children)

Just to be sure, you should check whether SSHD is enabled: sudo systemctl status sshd.service If you never enabled it and it's disabled+inactive, then no need to reinstall Tumbleweed per the current guidance. Also you can double check your version of xz to make sure it's downgraded, the downgraded version for Tumbleweed should look like this:

sudo zypper search -vi xz
Loading repository data...
Reading installed packages...

S  | Name | Type    | Version               | Arch   | Repository
---+------+---------+-----------------------+--------+------------------
i+ | xz   | package | 5.6.1.revertto5.4-3.2 | x86_64 | update-tumbleweed
    name: xz
[–] VinesNFluff@pawb.social 4 points 7 months ago* (last edited 7 months ago)

Checked. We good. Thanks, stranger.

[–] qaz@lemmy.world 1 points 7 months ago

What if it was enabled but it was disabled in the firewall so it could only be used from the device itself?

[–] theit8514@lemmy.world 5 points 7 months ago (1 children)

While the full extent of the exploit is not fully known, it seems specifically targeted at the sshd binary on deb and rpm based systems. If you've got that service disabled it should not have been running actively on your system. You should still perform whatever is needed to downgrade, but I would say you're in the clear.

[–] Link@rentadrunk.org 2 points 7 months ago (1 children)

What if you had the service enabled on an Arch based distro?

[–] theit8514@lemmy.world 1 points 7 months ago

Each distribution is different but Arch has stated that they did have the exploit artifact in their version of xz but the artifact was not loaded into memory with sshd as their process does not link sshd with liblzma library.

More details below but highly recommend upgrade/downgrade anyways to remove the exploit code version.

https://archlinux.org/news/the-xz-package-has-been-backdoored/