Ƙofar Baya ta XZ: "Wannan ya kasance kusa"

SSH na baya

Wani mai kula da miyagun halaye ko wanda aka yi wa rauni ya saka mummunan hali a cikin ɗakin karatu mai suna liblzma, wani ɓangare na kayan aikin matsewa na xz da ɗakunan karatu, wanda ke haifar da ƙofar baya a cikin SSH. Wannan wani hari ne na ci gaba na sarkar samar da software yayin da aka gyara ɗakin karatu da gangan don ƙofar baya, tare da ɓoyewa da dabarun ɓoye sirri don ɓoye nauyin harin daga masu bita.

An gano shi kuma an bayyana shi kwanan nan (a ranar 29 ga Maris da ta gabata), kuma ana ci gaba da sarrafa harin. Duk da haka, an shawo kansa cikin sauri domin da alama yana shafar sigar da aka riga aka saki na takamaiman saitin muhalli (fakitin DEB da RPM, don tsarin x86_64, kuma an gina shi da GCC). Ko ta yaya, CVE an ba shi Maki na tushe na CVSS na 10, wanda aka keɓe don mafi munin raunin tsaro na yanar gizo. Idan ya shiga cikin rarrabuwar kawuna masu dorewa, tasirin zai yi yawa.

Binciken fasaha na harin, gami da an yi bayani dalla-dalla game da ƙofar baya ta xz, an yi nazari a wani wuri. Wannan rubutun zai mayar da hankali kan jadawalin harin, yadda za a iya gano shi, yadda aka magance lamarin har zuwa yanzu, da kuma darussan da za a iya koya daga harin.

Dogon wutsiyar ƙofar baya ta ci gaba fiye da farkon lokacin. A watan Agusta na 2025, sama da shekara guda bayan an bayyana CVE-2024-3094, masu binciken tsaro a Binarly sun gano cewa har yanzu ƙofar baya tana nan a cikin hotuna goma sha biyu na Debian Docker da aka buga a Docker Hub, inda ƙungiyar Debian ta ƙi cire su, tana ɗaukar su a matsayin kayan tarihi na ci gaba maimakon haɗari mai aiki. A gefe guda, OpenSSF kuma OpenJS ta bayar da gargaɗin haɗin gwiwa jim kaɗan bayan faruwar lamarin XZ cewa irin wannan yunƙurin kwace iko a fannin zamantakewa ya riga ya kai hari ga ayyukan JavaScript, yana mai nuna cewa tsarin harin aminci da mai kula da shi ke amfani da shi a nan ana sake amfani da shi a wani wuri.

Yadda aka yi allurar ƙofar baya ta XZ

Lura: Ma'ajiyar git tana cikin git.tukaani.org. Duk da haka, akwai kuma wani Ma'ajiyar ajiya ta GitHub ta dauki nauyin (a halin yanzu an toshe) inda asusun GitHub ke saka canje-canjen da aka haɗa daga baya cikin ma'ajiyar Git.

Wani ɓangare na ƙofar baya yana kama da yana cikin tarballs ɗin da aka rarraba don nau'ikan 5.6.0 da 5.6.1, ba a cikin ma'ajiyar git ba kuma yana dogara ne akan Layi ɗaya a cikin ginin-zuwa-host.m4 fayil ɗin macro da autoconf ke amfani da shi. Sauran ɓangaren yana cikin fayilolin gwaji guda biyu da ake tsammani bad-3-corrupt_lzma2.xz da kuma mai kyau-babban_matsewa.lzma

sun kasance commitTed ta hanyar asusun GitHub "Jia Tan" (JiaT75) a cikin ma'ajiyar xz a ranar 23 ga Fabrairu. Sauyi ne mai ban tsoro da aka ƙara fayilolin gwaji (wanda ake tsammani tubalan da aka matse .lzma da .xz). Abin sha'awa, ba a yi amfani da fayilolin gwajin ta gwaje-gwajen ba! Layin da ke cikin fayil ɗin .m4 yana saka rubutun da aka ɓoye (wanda aka haɗa a cikin tarball) don aiwatarwa a ƙarshen saita idan wasu yanayi suka dace. Yana gyara Makefile don liblzma ɗakin karatu don ya ƙunshi lambar da ke fitar da bayanai daga fayil ɗin .xz, wanda bayan cire bayanai ya ƙare a cikin wannan rubutun, ana kiransa a ƙarshen saitawa. Yana yanke shawara ko za a gyara tsarin ginawa don shigar da lambar: kawai a ƙarƙashin GCC da mahaɗin GCC, a ƙarƙashin Debian ko rpm, kuma kawai don x86_64 Linux. Lokacin da aka daidaita, lambar da aka allurar tana katse aiwatarwa ta hanyar maye gurbin biyu ifunc masu warware matsaloli don haka ana maye gurbin wasu kira. Wannan yana sa a yi nazarin teburin alamomin a cikin ƙwaƙwalwa (wannan yana ɗaukar lokaci, wanda ya haifar da ganowa, kamar yadda aka bayyana daga baya).

Sai abubuwa su zama masu ban sha'awa: Ƙofar baya tana shigar da ƙugiya ta duba a cikin mahaɗin mai ƙarfi, tana jiran alamar aikin RSA_public_decrypt ta iso, wanda aka tura shi zuwa wani wuri cikin lambar ƙofar baya, wanda hakan ke mayar da kira. libcrypto, wataƙila don yin tantancewa ta al'ada. Kuma nauyin da aka ɗauka yana kunnawa idan shirin da ke gudana yana da sunan tsari /usr/sbin/sshdA bayyane yake cewa sabar SSH sune abin da ake nema. A al'ada, sshd ba a haɗa sabar kamar OpenSSH ba liblzma, amma sshd shine sau da yawa ana gyarawa don tallafawa systemd-notify don sauran ayyuka su fara lokacin da sshd ke aiki. Sannan kuma ana loda liblzma kai tsaye ta hanyar tsarin tsarin, rufe da'irar.

Ba a yi cikakken nazari kan ƙofar bayan ba tukuna, amma da alama haka ne ba da damar aiwatar da umarni daga nesa (RCE) tare da gatan sshd aljani, yana gudana a cikin mahallin tabbatarwa kafin a tabbatar. Bayanin da ke fitowa daga takardar shaidar nesa, idan aka haɗa shi da ƙofar baya, ana warware shi da ChaCha20, kuma idan ya warware shi cikin nasara, ana aika shi zuwa ga tsarin()Don haka wannan a zahiri RCE ce mai gate, mafi muni fiye da kawai hanyar wucewa ta maɓallin jama'a.

Wani ƙwallon tarball mai nauyin 5.6.1 daga baya ya nuna ƙarin ƙoƙari don ɓoye alamun, ƙara ƙarin ɓoye sunayen alamomi, da kuma ƙoƙarin gyara kurakuran da aka gani. tsarin fadadawa inda aka nemi ƙarin fayilolin gwaji don wasu sa hannu don ƙarawa a ƙofar baya an kuma sanya su a wurin.

Wannan harin mai sarkakiya zai iya wucewa ba tare da an lura da shi ba har sai an cimma daidaiton rarraba Linux. Abin farin ciki, wasu mutane suna son duba dalilin da yasa abubuwa marasa kyau ke faruwa.

Gano Harin Bayan Kofa na XZ

Sau da yawa ana gano miyagun halaye ta hanyar haɗari ko haɗari. Kyakkyawan misali shine gargaɗin rage darajar kuɗi ("Wa ya damu da gargaɗin?") wanda ya haifar da gano harin kwararar taron a watan Oktoba na 2018. Wani kuma shine mai amfani wanda ya yi gargaɗi Codecov a watan Afrilun 2021 cewa rubutun mai loda bash ɗinsu bai wuce checksum ba ("Wa ke tabbatar da ingancin kayan tarihi ta hanyar checksums"?") Abubuwan da ba su da kyau da kuma alamomin da ba su da kyau tare da ssh logins (logins ɗaukar CPU mai yawa da ƙaruwar lokacin da ya shuɗe, kurakurai na valgrind) sun tayar da sha'awar Andres Freund, mai haɓaka PostgreSQL mai hazaka amma ba mai nazarin tsaro ba (kamar yadda ya bayyanaBayan wani bincike da OpenSSH ta yi kan Debian Sid, ya kammala da cewa matsalar lokacin amsawa ta dogara ne akan ɗakin karatu, liblzma, Ɓangare na xz-kayan aiki ɗakin karatu na matsewa. Dalilin:an yi amfani da ma'ajiyar xz ta sama da kuma tarballs ɗin xz a baya"Wannan binciken ya yi daidai sosai! A ranar 29 ga Maris 2024 Andres ya buga bincike na farko a Openwall: “ƙofar baya a cikin xz/liblzma sama wanda ke haifar da sulhu tsakanin sabar ssh"Gaskiyar magana: XZ yana amfani da 5.6.0 da 5.6.1 tarballs suna ɗauke da ƙofar baya. An ƙirƙiri waɗannan tarballs kuma an sanya hannu a kansu ta asusun Jia Tan da aka ambata a sama. He an buga a cikin Mastodon daga baya a wannan ranar, ganin cewa ganowar ba da gangan ba ce kuma tana buƙatar haɗuwa da yawa. Sharhin wasu masu amfani ya cancanci a karanta. Mai amfani da GitHub samasam (wanda aka fi sani da Sam James) ya buga wani kyakkyawan Gist Tambayoyi akai-akai game da ƙofar baya ta xz-utils inda aka takaita harin, wanda ya haɗa da ƙarin bayani nazari mai zurfi na nauyin harin. Waɗannan binciken sun yi daɗi a zahiri, kuma sun taimaka mana mu fahimci allurar sosai, wadda aka yi cikakken bayani:

xz/liblzma: Bayanin Tasirin Bash-stageKyakkyawan bincike kan cire ƙuraje ta hanyar rubutun allura, a cikin "matakai" huɗu.
Zaren rubutun Filippo Valsorda mai suna bluesky Binciken ƙofar baya da kanta a cikin RSA_public_decrypt, wanda ke nuna yanayinsa: RCE, ba auth bypass ba, da kuma gated (yana karɓar maɓallin sirri na marubucin kuma idan ba haka ba, yana komawa ga ɗabi'ar da ta saba) / ba za a iya biya ba. Marubucin ya yi niyyar yin ƙasa da martaba don guje wa ganowa!
Binciken Ƙofar Baya na XZ ta @smx-smx (WIP) – Ƙarin bincike game da ƙofar baya (Na ɓace kusan a farkon 😀)
takardun bayan gida na xz wiki, wani bincike na rubutun allurar 5.6.1.

Wannan nice fosta daga Thomas Roccia yana nuna wani ɓangare na aikin JiaT75 akan ma'ajiyar GitHub, da kuma yadda rubutun allurar ke saka ƙofar baya ta binary, yana ƙara kwatantawa an yi bayanin ƙofar baya ta xz.

Yadda aka magance lamarin

Bayanin da Andreas Freund ya yi ya kasance cikin taka tsantsan domin, a cikin kalamansa:

"Ganin yadda lamarin ya kasance a sama, ban bayar da rahoton wata matsala a sama ba. Da farko na yi tunanin cewa matsalar debian ce, na aika wani rahoto na farko zuwa security@...ian.org. Daga baya, na kai rahoton matsalar ga distros@. CISAn sanar da A ta hanyar rarrabawa.

Red Hat ta ba da wannan fitowar CVE-2024-3094. Sai kalmar ta yaɗu kamar wutar daji. Lasse Collin, wani mai kula da XZ, ya ƙara da cewa sabon commit a ranar Asabar 30 ga Maris mai taken "CCake: Gyara duba akwatin sandlock mai lalacewa". An lalata ɗaya daga cikin hanyoyin toshe akwatin sandboxing na ɗakin karatu, aƙalla lokacin ginawa da CMake. Nan da nan ya bayyana matsalar a cikin XZ yana amfani da ƙofar baya. Red Hat ta sanya wannan matsala a gaba CVE-2024-3094 (duba kuma a cikin CVE, NVD, Ubuntu). An ba shi babban matsayi Maki na Tushe na CVSS na 10Irin waɗannan maki koyaushe suna ɗaukar Intanet da sauri. CISA ranar 29 ga Maris, an fitar da wani jijjiga, wataƙila ya yi sauƙi sosai saboda gaggawa, yana ba da shawarar masu amfani su rage zuwa sigar 5.4.6 mai karko. An kashe ma'ajiyar GitHub a ƙarƙashin ƙungiyar Tukaani (shin wannan yana da kyau ko mara kyau? Ina ganin yana da kyau: Yawancin distros da ƙungiyoyi har yanzu suna haɗa zuwa sakin GitHub don samo tarballs ɗin da suka kamu da cutar don ginawa. Kashe repo yana hana hakan. Ko ta yaya akwai kwafi ko wurin ajiyewa a git.tukaani.org). An dakatar da asusun GitHub na JiaTan75 da na Lasse Collins (Larhzu). Wannan wani ɓangare ne na tsarewa, koda kuwa yana iya shafar mutanen da ba su da laifi. JiaT75 aiki a cikin ma'ajiyar da ba ta da nakasa ba za a iya gani ba tukuna. Masana'antar ta mayar da martani cikin gaggawa. Masu sayar da kayayyaki da yawa sun buga ƙa'idodi don gano tsarin da ke da rauni, kamar Dokokin Yara, ko tallafi a cikin kayan aikin kasuwanci daga Sysdig, PAN, da sauransu. Ƙwararrun jami'an tsaro kamar James Berthoty ya wallafa game da yin bita kan yadda muke tunkarar manhajar bude-tushe. Yanzu haka muna cikin matakin Kawar da Muhalli na lamarin. Sauran ayyukan da JiaTan75 ke kula da su ana yin nazari sosai a kansu, musamman ma libarchive/libarchive (inda JiaTan75 ya kasance mai ba da gudummawa akai-akai) da kuma mai ba da labari oss-fuzz (inda wannan commit JiaTan75 ya yi ƙoƙarin guje wa oss-fuzz, wanda a zahiri bai iya gano ƙofar baya ba). Waɗannan yunƙurin ɓoyewa suna ƙara ƙarin shaida.

Su waye ke ƙarƙashin harin?

Ko dai an yi wa asusun GitHub JiaT75 kutse (ku tuna cewa GitHub ya ba da umarnin 2FA kwanan nan) ko kuma mai amfani da asusun ya koma gefe mara kyau. Amma akwai dalilai masu ƙarfi da za a yi tunanin barazanar ci gaba (APT), wataƙila ta hanyar gwamnati, saboda ƙwarewar fasaha ta harin. Ƙarin bincike daga hukumomin tsaro na yanar gizo da jami'an tsaro zai nuna… Wannan shigarwa a cikin YCombinator Hacker News game da Jia Tan yana ba da haske game da "wa" da ayyukansa. An ba da shawarar! Yana ba da bayanai da yawa game da yadda miyagun mutane ke ƙoƙarin yaudarar wasu masu amfani, ta amfani da injiniyan zamantakewa.

"Abin haushi ne ƙwarai - wanda ya bayyana a matsayin marubucin ƙofar baya yana tattaunawa da ni (rwmj) tsawon makonni da yawa yana ƙoƙarin ƙara xz 5.6.x zuwa Fedora 40 & 41 saboda "sabbin fasaloli masu kyau". Har ma mun yi aiki tare da shi don gyara matsalar valgrind (wanda yanzu ya zama sanadin ƙofar baya da ya ƙara). Dole ne mu yi tsere jiya da daddare don gyara matsalar bayan karya takunkumin ba da gangan ba. Ya kasance ɓangare na aikin xz na tsawon shekaru 2, yana ƙara duk nau'ikan fayilolin gwaji na binary, kuma a gaskiya da wannan matakin fasaha zan yi zargin ko da tsoffin sigogin xz har sai an tabbatar da akasin haka."

Jia Tan ta ɗauki matakai don hana a bin diddiginta: Da alama ta yi amfani da VPN (vpn.singapore.witopia.net) don haɗawa - wanda hakan yayi daidai. Kuma da alama canje-canje da yawa suna da alaƙa da imel na ɗan lokaci, na amfani ɗaya kawai (daga ProtonMail a wannan yanayin) suna kira da a haɗa canje-canje.

Mai wasan kwaikwayo na iya nufin zurfafa bincike, har zuwa kan Linux kernel, a matsayin mai ba da gudummawa ga wanda aka saka a cikin xy aikin. Wani bincike na farko bai gano wata shaida ta zubar da ciki ba, har zuwa yau.

Lura: wani mai ba da gudummawa mai ƙarancin girma na XZ "Hans Jansen" (Mai amfani da GitHub "hansjans162") shine karkashin bincikeAsusunsa a debian yanzu an katangeYa yi sabuntawa da yawa ga Wasannin Debian don ɓoye wanda yake so akan debian/xz-utils, sabuntawa zuwa sama da 5.6.1 don hanzarta rarraba ƙofar baya zuwa debian/maras tabbas.

Abin da kawai za mu iya cewa, a yanzu, shi ne cewa wannan APT ne (wanda har yanzu ba a san shi ba) wanda ke amfani da asusu daban-daban, yana aiki na akalla shekaru biyu a wannan kamfen, kuma yana aiki cikin haƙuri don dasa RCE a cikin SSH.

Har zuwa lokacin rubuta wannan labarin, ba a tabbatar da asalin "Jia Tan" ba. Babu wani ingantaccen bayanin da aka tabbatar ga wani mutum, ƙungiya, ko wani jami'in gwamnati da aka tabbatar a bainar jama'a, wanda hakan ya ƙarfafa yadda tsarin aikin mutum yake da tasiri.

An hana harin ƙofar baya na XZ?

Da wahala.

Da farko, wani ɓangare na ƙofar baya da aka yi wa allura ya shigo cikin fayilolin gwaji da aka matsa waɗanda gwaje-gwaje ba su yi amfani da su ba. A baya-bayan nan, hakan na iya tayar da wasu ƙararrawa (masu hayaniya), amma wa ya damu da duba cewa duk fayilolin gwaji ana amfani da su ta hanyar gwaje-gwaje na gaske a ainihin duniya? Na biyu, wani ɓangare na ƙofar baya da aka yi wa allura ya zo cikin fayilolin macro cikin tarballs ɗin da aka saki, kuma yana da wuya a duba da hannu don bambance-bambancen da aka yi wa tsammanin tarballs. Aiki da kai shi ma yana da rikitarwa, kamar yadda sakamakon da ake tsammani daga ginin kansa (ga duk wanda ya san yadda automake/autoconf ke aiki) yana da wuya a yi koyi da shi don nazarin ko ainihin tarball ɗin ya dace da tsammanin. Wasu sun yi ta yi as "Bambancin tarballs da ke tsakanin git tree alama ce ta musamman, ba kwaro ba"Asalin tarballs na binary daga lambar tushe matsala ce da ba a warware ba.

Sunan mai amfani? To, asusun GitHub na JiaTan75 bai yi abubuwa marasa amfani ba kamar yadda ya gabata. commits. An dakatar da shi ne kawai bayan da shaidu suka tattara, amma har zuwa 29 ga Maris, mai amfani da shi na yau da kullun yana gudanar da harkokin kasuwanci na yau da kullun. To, ba haka al'ada ba ce. Daga baya commits (wannan, wannan, wannan, Da kuma wannan wanda ya daidaita lambar amfani) ya yi ƙoƙarin gyara kurakuran valgrind kuma ya faɗi a wasu tsare-tsare, saboda bambance-bambancen da aka samu tare da tsarin tari da ƙofar baya ke tsammani. Commit sake dubawa za su iya gano wannan, amma wa ke da haƙurin yin nazarin canje-canje a cikin fayil ɗin gwaji na binary ko ainihin dalilin canji a cikin halayen GCC a cikin lambar tushe ta C?

Ya kamata mutum ya ɗaga ƙararrawa lokacin da aka gano SSH login yana ɗaukar 800 ms maimakon 300 ms? Wataƙila mutane masu hankali ne kawai za su lura. Cicero ya ce, "Rashin hankali yana ga ƙuruciya; hankali yana ga tsufa."

An ƙara kayayyakin more rayuwa na ifonc a watan Yunin 2023 ta hannun "Hans Jansen" da "Jia Tan". Wannan shine na farko commit ƙara tallafin ifunc zuwa crc64_fast.c (daga baya ana amfani da shi don allurar ƙofar baya). Watanni kafin a saka binary na ƙofar baya a cikin fayilolin gwaji!

Lura: Marubuci da commitAkwai bambanci a nan, amma wannan abu ne na al'ada: Lasse Collin shine mai kula da aikin, kuma ya haɗa canje-canjen. Har ma ya gode wa "Hans Jansen" ...

Babu wanda ya nuna damuwa kafin rubutun Andres Freund da kuma CVE da RedHat ta ƙirƙira. Idan ka ga tarin kayan aikin da za su iya gano wannan, za su gano ɓangaren da abin ya shafa yanzu, tsohon post facto.

Wataƙila mafi kyawun rigakafin ya fito ne daga yanayin rarrabawar Linux, da kuma yadda nau'ikan da ba su da ƙarfi, masu faɗi da yawa ke wucewa zuwa rarrabawa masu ƙarfi bayan tsari mai sauri.

Darussa da aka Koya daga harin XZ bBackdoor

Mun lura da yadda yake da wahalar ganowa ganganci Ƙofofin baya. Ya kamata a ɗauki ƙofofin baya a matsayin barazana ta ciki, domin ma'aikatan cikin gida ne suka dasa su ko kuma ta hanyar asusun cikin gida da aka yi wa lahani. Kuma waɗannan mutanen galibi ana amincewa da su. Kuma idan aka dasa ƙofar baya a cikin kayan tarihi da aka rarraba, yana sa ya yi wuya a gano shi.

Wasu marubuta kamar Kevin Beaumont an nuna a tsarin, wanda ke buɗe babban filin kai hari na ayyukan ɓangare na uku zuwa ƙofar baya. Wannan shine abin da mugun ɗan wasan ya zage shi a nan. Systemd yana da idanu da yawa, amma XZ wani ɗakin karatu ne da ba a san shi ba a sama. "Lokacin da aka gurɓata ruwan sama, kowa yana shan ruwa mai guba a ƙasa".

Buƙatar canji mara alaƙa a cikin tsarin don loda ɗakunan karatu na matsawa akai-akai, wanda zai cire ƙofar baya, an riga an haɗa shi cikin tsarin amma ba a kawo shi ba tukuna. Ƙarin dogaro da libsystemd ya gabatar na iya zama tushen raunin da ya faru, kuma jiya an buɗe wannan buƙatar.

A comment a cikin "xz: Kashe ifunc don gyara Matsalar" commit ya ba da haske mai zurfi kan inda za a mayar da hankali idan muna son hana irin wannan aiki (nawa ne abin da ya fi muhimmanci):

"Darasin da ya kamata mu koya a matsayinmu na al'umma shine mafi aminci software supply chain security a takaice dai, ana duba tsarin ginawa fiye da lambar tushe kawai. Kamar kutsen SolarWinds inda maharan suka canza sabunta software don bayar da software na sa ido na SolarWinds a rufe.

Ganowa da wuri da kuma martanin gaggawa ya takaita tasirin sosai. Idan kun tuna ƙarshen yanayin daga Maza a cikin Baƙar fata na III: "Wannan ya kasance kusa". Kuma, K bai manta da barin tip ɗin ba. Kuma babu wani boglodite da ya shiga rarraba Linux mai karko.

1. "Ni *ba* mai binciken tsaro ba ne, kuma ba injiniyan baya ba ne." 2. Jia sunan da aka fi sani da sunan kasar Sin ne. Tan kuma sunan iyali ne da aka fi sani da "mai girma". Mutane da yawa da ba su da alaƙa suna da wannan sunan, don Allah kada ku la'anci kowa da wannan sunan!

Kofar baya ta XZ: "Wannan ya kasance kusa"

Rubuce-rubucen da Ya Kamata a Karanta