The code and data behind xeiaso.net
notes: xz secvuln
Signed-off-by: Xe Iaso <me@xeiaso.net>
+69
+69
lume/src/notes/2024/xz-vuln.mdx
+69
lume/src/notes/2024/xz-vuln.mdx
···
1
+
---
2
+
title: "liblzma and xz version 5.6.0 and 5.6.1 are vulnerable to arbitrary code execution compromise"
3
+
date: 2024-03-29
4
+
hero:
5
+
ai: "Photo by Xe Iaso, EOS R10 with 135mm Super-Multi-Coated Takumar f/3.5"
6
+
file: xz-alert
7
+
prompt: "A stop sign on a blue sky with the words 'security alert' underneath it"
8
+
---
9
+
10
+
This is a new situation and we are still gathering information. Here is what we know so far:
11
+
12
+
The [xz/liblzma project](https://github.com/tukaani-project/xz) has released versions 5.6.0 and 5.6.1.
13
+
14
+
The combination of this and patches made by some distributions to the interactions between liblzma, libsystemd, and sshd have resulted in a situation where an attacker can compromise a system by sending a malicious payload to an sshd server.
15
+
16
+
We are lucky. This only affects AMD64 Linux systems. The vulnerability is in a specific RSA function. The exploit is in the wild. This is also a very new version of xz/liblzma, so it is not widely deployed yet. This is also unlikely to affect anything other than Glibc (because of glibc IFUNC support), so if you use [musl](https://musl.libc.org/) or another libc implementation, you are likely safe.
17
+
18
+
If you are using a distribution that has not yet released xz 5.6.0 or 5.6.1, you are likely safe.
19
+
20
+
If you are running Debian sid, Fedora 41, or Fedora Rawhide, run updates now.
21
+
22
+
Here are the distros where it is likely to be released (according to [repology](https://repology.org/project/xz/versions)):
23
+
24
+
- Alpine Edge
25
+
- Arch
26
+
- Cygwin
27
+
- Exherbo
28
+
- Gentoo
29
+
- Homebrew
30
+
- KaOS
31
+
- MacPorts
32
+
- Manjaro Testing
33
+
- NixOS Unstable/nixpkgs unstable
34
+
- OpenIndiana
35
+
- OpenMamba
36
+
- OpenMandriva Rolling
37
+
- Parabola
38
+
- PCLinuxOS
39
+
- Pisi Linux
40
+
- pkgsrc current
41
+
- Ravenports
42
+
- Slackware current
43
+
- Solus
44
+
- Termux
45
+
- Wikidata
46
+
47
+
If you are using one of these distributions, you should check to see if you are using xz version 5.6.0 or 5.6.1. If you are, you should downgrade to 5.4.6. If you can't downgrade, you should disable public-facing SSH servers until you can downgrade.
48
+
49
+
At this time, we believe that version 5.4.6 is not vulnerable to this exploit. If you are using a different version, you should check with your distribution's security mailing list to see if you are vulnerable. If you are not already subscribed to your distribution's security mailing list, you should do so now.
50
+
51
+
Here is how you can tell if you're running the affected version:
52
+
53
+
```
54
+
xz --version
55
+
```
56
+
57
+
Here is what the output on the vulnerable version looks like:
58
+
59
+
```
60
+
$ xz --version
61
+
xz (XZ Utils) 5.6.1
62
+
liblzma 5.6.1
63
+
```
64
+
65
+
Stay tuned for more information. [Red Hat's security advisory](https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users) may be helpful.
66
+
67
+
---
68
+
69
+
Special thanks to titanous for pre-vetting this before it went live.