Malicious SSH backdoor sneaks into xz, Linux world's data compression library
(2024/03/29)
- Reference: 1711749516
- News link: https://www.theregister.co.uk/2024/03/29/malicious_backdoor_xz/
- Source link:
Red Hat on Friday warned that a malicious backdoor found in the widely used data compression library called xz may be present in Fedora Linux 40 and in the Fedora Rawhide developer distribution.
The IT giant said the malicious code, which appears to provide remote backdoor access via SSH and systemd, is present in xz 5.6.0 and 5.6.1. The vulnerability has been designated [1]CVE-2024-3094 . It is rated 10 out of 10 in CVSS severity.
Users of Fedora Linux 40 may have received 5.6.0, depending upon the timing of their system updates, according to Red Hat. And users of Fedora Rawhide, the current development version of what will become Fedora Linux 41, may have received 5.6.1. Fedora 40 and 41 have not been officially released yet; version 40 is due out next month.
[2]
Users of other Linux and OS distributions should check to see which version of the xz suite they have installed. The infected versions, 5.6.0 and 5.6.1, were [3]released on February 24 and March 9, respectively, and may not been incorporated into too many people's deployments. This supply-chain compromise may have been caught early enough to prevent widespread exploitation, and only mainly affect bleeding-edge distros.
[4]
[5]
[6]Debian and [7]Kali Linux have indicated they are, like Fedora, affected to some degree; all users should take action to identify and remove any backdoored builds of xz.
"PLEASE IMMEDIATELY STOP USAGE OF ANY FEDORA RAWHIDE INSTANCES for work or personal activity," the IBM subsidiary's [8]advisory shouted from the rooftops today. "Fedora Rawhide will be reverted to xz-5.4.x shortly, and once that is done, Fedora Rawhide instances can safely be redeployed."
[9]
Red Hat Enterprise Linux (RHEL) is not affected.
[10]Open source software has its perks, but supply chain risks can't be ignored
[11]Sysadmins: Why not simply verify there's no backdoor in every program you install, and thus avoid any cyber-drama?
[12]CIOs largely believe their software supply chain is vulnerable
[13]How 'sleeper agent' AI assistants can sabotage your code without you realizing
The malicious code in xz versions 5.6.0 and 5.6.1 has been obfuscated, Red Hat says, and is only fully present in the source code tarball. Second-stage artifacts within the Git repo get turned into malicious code through the M4 macro in the repo during the build process, resulting in a poisoned xz library that gets unwittingly used by software, such as the operating system's systemd. The malware appears to have been engineered to alter the operation of OpenSSH server daemons that use the library via systemd.
"The resulting malicious build interferes with authentication in sshd via systemd," Red Hat explains. "SSH is a commonly used protocol for connecting remotely to systems, and sshd is the service that allows access."
This authentication interference has the potential to allow a miscreant to break sshd authentication and remotely gain unauthorized access to an affected system. To us the backdoor appears to work like this: Linux machines install the backdoored xz library – specifically, liblzma – and this dependency in turn is ultimately used in some way by the computer's OpenSSH daemon. At that point, the poisoned xz library is able to interfere with the daemon, and (for example) allow an unauthorized miscreant to log in remotely. In which case, this backdoor primarily affects systemd-based servers that offer remote SSH access.
As Red Hat put it:
Under the right circumstances this interference could potentially enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely.
A [14]post to the Openwall security mailing list by Andres Freund, PostgreSQL developer and commiter, explores the vulnerability in greater detail.
AI hallucinates software packages and devs download them [15]READ MORE
"The backdoor initially intercepts execution by replacing the ifunc resolvers crc32_resolve(), crc64_resolve() with different code, which calls _get_cpuid(), injected into the code (which previously would just be static inline functions). In xz 5.6.1 the backdoor was further obfuscated, removing symbol names," Freund explains, with the caveat that he's not a security researcher or reverse engineer.
Freund speculates that the code "seems likely to allow some form of access or other form of remote code execution."
[16]
The account name associated with the offending commits, together with other details like the time those commits were made, has led to [17]speculation that the author of the malicious code is a sophisticated attacker, possibly affiliated with a nation-state agency.
The US government's Cybersecurity and Infrastructure Security Agency (CISA) has already issued an advisory [18]here . ®
Get our [19]Tech Resources
[1] https://access.redhat.com/security/cve/CVE-2024-3094
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZgdIBma83wKw7S3UmL8LagAAABA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://github.com/tukaani-project/xz/blob/master/NEWS
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZgdIBma83wKw7S3UmL8LagAAABA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZgdIBma83wKw7S3UmL8LagAAABA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://security-tracker.debian.org/tracker/CVE-2024-3094
[7] https://twitter.com/kalilinux/status/1773786266074513523
[8] https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZgdIBma83wKw7S3UmL8LagAAABA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2023/02/22/open_software_supply_chain_risks/
[11] https://www.theregister.com/2021/07/31/enisa_supply_chain_attack_report/
[12] https://www.theregister.com/2022/05/31/cio_supply_chain/
[13] https://www.theregister.com/2024/01/16/poisoned_ai_models/
[14] https://www.openwall.com/lists/oss-security/2024/03/29/4
[15] https://www.theregister.com/2024/03/28/ai_bots_hallucinate_software_packages/
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZgdIBma83wKw7S3UmL8LagAAABA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://news.ycombinator.com/item?id=39865810
[18] https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094
[19] https://whitepapers.theregister.com/
The IT giant said the malicious code, which appears to provide remote backdoor access via SSH and systemd, is present in xz 5.6.0 and 5.6.1. The vulnerability has been designated [1]CVE-2024-3094 . It is rated 10 out of 10 in CVSS severity.
Users of Fedora Linux 40 may have received 5.6.0, depending upon the timing of their system updates, according to Red Hat. And users of Fedora Rawhide, the current development version of what will become Fedora Linux 41, may have received 5.6.1. Fedora 40 and 41 have not been officially released yet; version 40 is due out next month.
[2]
Users of other Linux and OS distributions should check to see which version of the xz suite they have installed. The infected versions, 5.6.0 and 5.6.1, were [3]released on February 24 and March 9, respectively, and may not been incorporated into too many people's deployments. This supply-chain compromise may have been caught early enough to prevent widespread exploitation, and only mainly affect bleeding-edge distros.
[4]
[5]
[6]Debian and [7]Kali Linux have indicated they are, like Fedora, affected to some degree; all users should take action to identify and remove any backdoored builds of xz.
"PLEASE IMMEDIATELY STOP USAGE OF ANY FEDORA RAWHIDE INSTANCES for work or personal activity," the IBM subsidiary's [8]advisory shouted from the rooftops today. "Fedora Rawhide will be reverted to xz-5.4.x shortly, and once that is done, Fedora Rawhide instances can safely be redeployed."
[9]
Red Hat Enterprise Linux (RHEL) is not affected.
[10]Open source software has its perks, but supply chain risks can't be ignored
[11]Sysadmins: Why not simply verify there's no backdoor in every program you install, and thus avoid any cyber-drama?
[12]CIOs largely believe their software supply chain is vulnerable
[13]How 'sleeper agent' AI assistants can sabotage your code without you realizing
The malicious code in xz versions 5.6.0 and 5.6.1 has been obfuscated, Red Hat says, and is only fully present in the source code tarball. Second-stage artifacts within the Git repo get turned into malicious code through the M4 macro in the repo during the build process, resulting in a poisoned xz library that gets unwittingly used by software, such as the operating system's systemd. The malware appears to have been engineered to alter the operation of OpenSSH server daemons that use the library via systemd.
"The resulting malicious build interferes with authentication in sshd via systemd," Red Hat explains. "SSH is a commonly used protocol for connecting remotely to systems, and sshd is the service that allows access."
This authentication interference has the potential to allow a miscreant to break sshd authentication and remotely gain unauthorized access to an affected system. To us the backdoor appears to work like this: Linux machines install the backdoored xz library – specifically, liblzma – and this dependency in turn is ultimately used in some way by the computer's OpenSSH daemon. At that point, the poisoned xz library is able to interfere with the daemon, and (for example) allow an unauthorized miscreant to log in remotely. In which case, this backdoor primarily affects systemd-based servers that offer remote SSH access.
As Red Hat put it:
Under the right circumstances this interference could potentially enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely.
A [14]post to the Openwall security mailing list by Andres Freund, PostgreSQL developer and commiter, explores the vulnerability in greater detail.
AI hallucinates software packages and devs download them [15]READ MORE
"The backdoor initially intercepts execution by replacing the ifunc resolvers crc32_resolve(), crc64_resolve() with different code, which calls _get_cpuid(), injected into the code (which previously would just be static inline functions). In xz 5.6.1 the backdoor was further obfuscated, removing symbol names," Freund explains, with the caveat that he's not a security researcher or reverse engineer.
Freund speculates that the code "seems likely to allow some form of access or other form of remote code execution."
[16]
The account name associated with the offending commits, together with other details like the time those commits were made, has led to [17]speculation that the author of the malicious code is a sophisticated attacker, possibly affiliated with a nation-state agency.
The US government's Cybersecurity and Infrastructure Security Agency (CISA) has already issued an advisory [18]here . ®
Get our [19]Tech Resources
[1] https://access.redhat.com/security/cve/CVE-2024-3094
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZgdIBma83wKw7S3UmL8LagAAABA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://github.com/tukaani-project/xz/blob/master/NEWS
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZgdIBma83wKw7S3UmL8LagAAABA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZgdIBma83wKw7S3UmL8LagAAABA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://security-tracker.debian.org/tracker/CVE-2024-3094
[7] https://twitter.com/kalilinux/status/1773786266074513523
[8] https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZgdIBma83wKw7S3UmL8LagAAABA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2023/02/22/open_software_supply_chain_risks/
[11] https://www.theregister.com/2021/07/31/enisa_supply_chain_attack_report/
[12] https://www.theregister.com/2022/05/31/cio_supply_chain/
[13] https://www.theregister.com/2024/01/16/poisoned_ai_models/
[14] https://www.openwall.com/lists/oss-security/2024/03/29/4
[15] https://www.theregister.com/2024/03/28/ai_bots_hallucinate_software_packages/
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZgdIBma83wKw7S3UmL8LagAAABA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://news.ycombinator.com/item?id=39865810
[18] https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094
[19] https://whitepapers.theregister.com/
Re: CVSS 10 eh?
Jamie Jones
[1]Problem solved.
[1] https://upload.wikimedia.org/wikipedia/en/0/06/Spinal_Tap_-_Up_to_Eleven.jpg
SytemD?
Will Godfrey
What on earth is the connection between that and xz?
Re: SytemD?
Mike007
I suspect systemd is used to reconfigure the ssh service in some way. If you simply edit the config file someone might notice...
Getting something like this in to every server that installs an OS update without anyone noticing is the sort of thing that earns you a sophisticated attacker badge.
Re: SytemD?
David 132
If you have to ask that, you really haven't been paying attention to the inexorable feature creep of systemd :)
Re: SytemD?
Fazal Majid
systemd is linked against liblzma, which has the backdoor. OpenSSH has nothing to do with systemd but many distros tamper with it to interface with systemd, thereby introducing this vulnerability.
Re: SytemD?
Jamie Jones
From: [1]https://www.openwall.com/lists/oss-security/2024/03/29/4
"openssh does not directly use liblzma. However debian and several other
distributions patch openssh to support systemd notification, and libsystemd
does depend on lzma."
[1] https://www.openwall.com/lists/oss-security/2024/03/29/4
CVSS 10 eh?
Lucky it wasn’t in the kernel then.