3 ms·
My Ubuntu /usr/sbin/sshd already links to libz, liblzma, liblz4 and libzstd. I don't see why linking to libxz would be so outrageous. All-in-all, ldd reports 26
by tommiegannert 2y ago
My Ubuntu /usr/sbin/sshd already links to libz, liblzma, liblz4 and libzstd. I don't see why linking to libxz would be so outrageous. All-in-all, ldd reports 26 libraries.
They attacked the weakest link, and systemd was just a small pawn in that game. Sure, a smaller attack surface is better, but it's not like OpenSSHd has a small attack surface even without libsystemd. Not even in projects with a similar possibility of obscure "test data."
- michaelmrose 2y agoIn void it links 11 and includes only libz of the items you listed.
- t-3 2y agoOn OpenBSD it links 4 libraries. On my crux linux installation, 7.
- jwilk 2y ago> My Ubuntu /usr/sbin/sshd already links to libz, liblzma, liblz4 and libzstd. Except for libz, they are only linked indirectly through libsystemd. > I don't see why linking to libxz would be so outrageous The XZ Utils library is called liblzma, not libxz.
- tommiegannert 2y ago> Except for libz, they are only linked indirectly though libsystemd. Ah, that invalidates my point re. obscure test data. Sloppy use of ldd. (I'm guessing it would be much harder making such an attack on a crypto library.) Thanks.