11

Here's a hot topic:

I'm not an expert in reverse engineering, so my questions are:

Is only SSHD affected? Does merely having the sshd daemon run is enough to get your system compromised or the attacker must have actually accessed the compromised system? Many more packages depend on (are linked to) liblzma including: RPM, GRUB, KMOD, systemd, etc.

Systemd is run by default, RPM is run whenever you do anything with your packages.

5
  • 2
    This is an evolving story and there are currently not really more information out there apart from what you reference (and what might be referenced from there). I'm not sure what answer you expect here - do you think we know more than what is currently public available? Please just wait a while and I'm sure there will be updated information made available both from the community and from the distribution vendors which describe the potential impact in more detail. Mar 29 at 19:55
  • 1
    @SteffenUllrich the malware payload is public. You can download, disasm and inspect it. I expected people here to able to do that. If no one is willing/capable, that's also OK. Mar 29 at 21:10
  • 1
    "Does merely having the sshd daemon run is enough to get your system compromised?" The analysis notes that malicious code is called during sshd pre-auth, so this sounds likely. However, it is unlikely you are running a vulnerable version unless on a pre-release distro version. Mar 30 at 16:52
  • Fedora 40 beta was not vulnerable, Rawhide was. Mar 30 at 17:48

1 Answer 1

8

If you're 100% sure your system has not been accessed, you may simply downgrade xz and sleep tight. There's nothing to worry about. The exploit only affects the sshd authentication mechanism. It has no persistence and it doesn't alter your system in any way. The bad actor decided to play it safe.

More details here: https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/

If you have reasons to believe hackers may have logged in, you need to wipe everything clean and reset all the passwords hackers may have accessed. Unfortunately the payload is written such a way, the attacker gets a root session automatically. Please refer to this question for more information: How do I deal with a compromised server?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .