4 ms·
I guess systemd uses liblzma to automatically compress logs after a configurable timeframe (e.g., daily).
by zekrioca 3y ago
I guess systemd uses liblzma to automatically compress logs after a configurable timeframe (e.g., daily).
- brokenmachine 3y agoBut wasn't it a backdoor, ie the attacker has to connect via sshd with a specific pubkey to make it run bad commands? As I understand it, just the mere fact liblzma runs on a schedule wouldn't cause it to do anything nefarious.
- 1oooqooq 3y agoso you don't understand it... read on https://www.openwall.com/lists/oss-security/2024/03/29/4 https://www.openwall.com/lists/oss-security/2024/03/29/4 look for the part: "These functions get resolved during startup"
- brokenmachine 3y agoAah, so sshd gets backdoored because systemd calls xz.
- 1oooqooq 3y agono. anything in the dependency tree could call that lib. systemd is the first. systemd also provides libs to write things the exploit will use. but the important part you missed again is that the exploit is executed on symbols loading. it just choose to do just of the work when checking for a key. but after simply starting the code it's all lost already. nothing needs to call any code on libzma, just linking against it is enough to run the exploit.
- brokenmachine 3y agoCalls/links to. meh "important part you missed again" comes off as rude to me. Check yourself.
- 1oooqooq 3y agoit's actually the only interesting part of the exploit code. everything else is just very lame obfuscation