XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable."

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by sebiw on Saturday March 30, 2024 @05:19PM (#39878767)

Arch Linux uses a native/unpatched version of OpenSSH without dependency on libsystemd and thus without dependency on xz-utils, resulting in no exploitable code path. This means that at least the currently talked about vulnerability/exploit via SSH did presumably not work on Arch. Disclaimer: This is my understanding of the currently circulating facts. Additional fallout might be possible, as the reverse engineering of the backdoor is ongoing.

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by pas on Saturday March 30, 2024 @07:12PM (#39879564)

there are other ways for liblzma to get into ssh (via PAM and libselinux)

[ Parent | on HN ]

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by Deathcrow on Sunday March 31, 2024 @02:47AM (#39881998)

This is only correct if the sshd backdoor is the only malicious code introduced into the library.

[ Parent | on HN ]