I-SSH yokungena ngasemva
Umgcini-zincwadi okhohlakeleyo okanye obuthathaka ufake isimilo esibi kwithala leencwadi elibizwa ngokuba i-liblzma, inxalenye yezixhobo zoxinzelelo lwe-xz kunye neelayibrari, nto leyo ebangele ukuba kubekho ucango lwangasemva kwi-SSH. Olu luhlaselo oluphambili lwesoftware supply chain njengoko ithala leencwadi liguqulwe ngabom kwi-backdoor, nge-obfuscation kunye neendlela ezifihlakeleyo zokufihla umthwalo wohlaselo kubahloli.
Ifunyenwe kwaye yatyhilwa kutshanje (nge-29 kaMatshi edlulileyo), kwaye ukuphathwa kohlaselo kuyaqhubeka. Nangona kunjalo, yathintelwa ngokukhawuleza njengoko ibonakala ngathi ichaphazela kuphela iinguqulelo zangaphambi kokukhululwa kweseti yeendawo ezilinganiselweyo (iiphakheji ze-DEB kunye ne-RPM, zoyilo lwe-x86_64, kwaye zakhiwe nge-GCC). Nokuba kunjalo, i CVE wanikwa i Amanqaku esiseko seCVSS kwe-10, egcinelwe ezona ngxaki zibalulekileyo zokhuseleko lwe-intanethi. Ukuba ingena kulwabiwo oluzinzileyo, impembelelo iya kuba nkulu kakhulu.
Uhlalutyo lobuchwephesha lohlaselo, kuquka xz backdoor ichazwe nzulu, ihlalutywe kwenye indawo. Eli nqaku liza kugxila kuluhlu lwexesha lohlaselo, indlela olunokubhaqwa ngayo, indlela esiphathwe ngayo esi siganeko ukuza kuthi ga ngoku, kunye nezifundo ezinokufunyanwa kolu hlaselo.
Umsila omde womnyango ongasemva uqhubekile ixesha elide udlula kwindawo yokuqala. Ngo-Agasti 2025, emva konyaka emva kokuba i-CVE-2024-3094 ityhilekile, abaphandi bezokhuseleko eBinarly bafumanise ukuba lo mnyango ongasemva usabonakala kwimifanekiso elishumi elinesibini yeDebian Docker epapashwe kwiDocker Hub, iqela leDebian lingavumi ukuyisusa, liyiphatha njengezinto zakudala zophuhliso endaweni yomngcipheko osebenzayo. OpenSSF kwaye i-OpenJS ikhuphe isilumkiso esidibeneyo emva nje kwesiganeko se-XZ sokuba imizamo efanayo yokuthathwa kobunjineli bezentlalo yayisele ijolise kwiiprojekthi zeJavaScript, nto leyo ebonisa ukuba indlela yokuhlasela i-maintainer-trust esetyenziswa apha isetyenziswa kwakhona kwenye indawo.
Indlela i-XZ backdoor eyafakwa ngayo
Qaphela: Indawo yokugcina izinto ze-git ikwi git.tukaani.org. Nangona kunjalo, bekukho ne Indawo yokugcina izinto ephethwe yiGitHub (ngoku ivaliwe) apho iakhawunti yeGitHub yayithumela utshintsho olwathi kamva lwadityaniswa kwindawo yokugcina izinto yeGit.
Inxalenye enye yomnyango ongasemva ibonakala ikwii-tarballs ezisasaziweyo kwiinguqulelo ze-5.6.0 kunye ne-5.6.1, kungekhona kwiindawo zokugcina i-git kwaye ixhomekeke kwi umgca omnye kwi-build-to-host.m4 ifayile ye-macro esetyenziswe yi-autoconf. Elinye icandelo lalikwiifayile ezimbini zovavanyo ezicingelwayo i-bad-3-corrupt_lzma2.xz kwaye good-large_compressed.lzma
ezazikhona commitTed yiakhawunti yeGitHub ethi “Jia Tan” (JiaT75) kwi indawo yokugcina izinto ye-xz nge-23 kaFebruwari. Yayilutshintsho olungenabungozi longeza ii-testfiles (ekuthiwa yi-.lzma kunye ne-.xz iibhloko ezicinezelweyo). Okubangela umdla kukuba, iifayile zovavanyo azisetyenziswanga ziimvavanyo! Umgca kwifayile ye-.m4 ufaka iskripthi esifihliweyo (esifakiwe kwi-tarball) esiza kuphunyezwa ekupheleni kwe-configure ukuba ezinye iimeko ziyahambelana. Itshintsha i-Makefile ye i-liblzma ilayibrari iqulethe ikhowudi ekhupha idatha kwifayile ye-.xz, ethi emva kokuba i-deobfuscation iphele kule script, ibizwa ekupheleni kokumisela. Igqiba ekubeni itshintshe inkqubo yokwakha ukuze ifake ikhowudi: kuphela phantsi kweGCC kunye ne-GCC linker, phantsi kweDebian okanye i-rpm, kwaye kuphela kwi-x86_64 Linux. Xa ifaniswa, ikhowudi efakelweyo ithintela ukwenziwa ngokutshintsha ezimbini ifunc izisombululo ukuze iifowuni ezithile zitshintshwe. Oku kubangela ukuba iitafile zeempawu zihlalutywe kwimemori (oku kuthatha ixesha, nto leyo ekhokelele ekufumanekeni, njengoko kuchaziwe kamva).
Emva koko izinto ziba nomdla: I-backdoor ifaka i-audit hook kwi-dynamic linker, ilinde ukuba uphawu lomsebenzi we-RSA_public_decrypt lufike, oluthunyelwa kwinqanaba elithile kwikhowudi ye-backdoor, ethi yona itsalele umva. libcrypto, mhlawumbi ukwenza uqinisekiso oluqhelekileyo. Kwaye umthwalo womvuzo usebenza ukuba inkqubo esebenzayo inegama lenkqubo /usr/sbin/sshdKwakucacile ukuba iiseva ze-SSH yayizizo ezijoliswe kuzo. Ngokwesiko, ssh iiseva ezifana ne-OpenSSH azizange ziqhagamshelwe i-liblzma, kodwa i-sshd yi ihlala ilungiswa ukuxhasa i-systemd-notify ukuze ezinye iinkonzo ziqale xa i-sshd isebenza. Kwaye i-liblzma ilayishwa ngokungathanga ngqo yi inkqubo, evala isangqa.
Umnyango ongasemva awukahlalutywa ngokupheleleyo, kodwa kubonakala ngathi ukuvumela ukuphunyezwa komyalelo okude (RCE) ngamalungelo e-sshd daemon, isebenza kwimeko yokuqinisekiswa kwangaphambili. Ulwazi oluvela kwisatifikethi esikude, xa lufaniswa nomnyango ongasemva, luyacinywa ngeChaCha20, kwaye xa lucinywa ngempumelelo ludluliselwa kwi inkqubo()Ngoko ke le yi-RCE evalwe ngesango, imbi kakhulu kunendlela nje yokudlula kwisitshixo sikawonke-wonke.
I-tarball ye-5.6.1 kamva ibonise imizamo eyongezelelweyo yokufihla imikhondo, yongeza ukufiphaza okungakumbi kwamagama eempawu, kwaye izama ukulungisa iimpazamo eziboniweyo. indlela yokwandisa apho kwakufuneka kukhangelwe khona ezinye iifayile zovavanyo ukuze kufakwe ezinye iimpawu zokufaka kumnyango ongasemva.
Olu hlaselo lunobuchule lunokungabonwa de kufikelelwe kulwabiwo oluzinzileyo lweLinux. Ngethamsanqa, abanye abantu bathanda ukujonga ukuba kutheni izinto ezingaqhelekanga zisenzeka.
Ukufunyanwa kohlaselo lwe-XZ Backdoor
Izihlandlo ezininzi ukuziphatha okubi okufakwe kwi-influence kufunyaniswa ngengozi okanye ngengozi. Umzekelo omhle yayikukuba isilumkiso sokuyekiswa (“Ngubani okhathaleleyo ngezilumkiso?”) ezakhokelela ekufumanekeni uhlaselo lokusasazwa kweziganeko ngo-Okthobha ka-2018. Omnye ngumsebenzisi olumkisileyo Codecov ngo-Epreli 2021 ukuba iskripthi sabo se-bash uploader asizange siphumelele i-checksum (“Ngubani oqinisekisa ukuthembeka kwezinto zakudala ezine-checksums”?) Izinto ezingaqhelekanga kunye neempawu ezingaqhelekanga nge-ssh logins (loginukuthatha i-CPU eninzi kunye nokwanda kwexesha elidlulileyo, iimpazamo ze-valgrind) zivuse umdla wokuba UAndres Freund, umphuhlisi wePostgreSQL ophaphileyo kodwa kungekhona umhlalutyi wokhuseleko (njengoko watshoyoEmva kophando oluthile ne-OpenSSH kwi-Debian Sid, wagqiba kwelokuba ingxaki yexesha lokuphendula ixhomekeke kwithala leencwadi, i-liblzma, inxalenye ye xz-izixhobo ilayibrari yokucinezela. Isizathu: “indawo yokugcina i-xz ephezulu kunye nee-xz tarballs zivaliwe". Olu xilongo beluchanekile kakhulu! Ngomhla wama-29 kuMatshi 2024 uAndres wabhala kwi-Openwall uhlalutyo lokuqala: “i-backdoor kwi-upstream xz/liblzma ekhokelela kwi-ssh server compromise"Inyani: Ii-tarball ze-XZ Utils 5.6.0 kunye ne-5.6.1 ziqulathe ucango olungasemva. Ezi tarball zenziwe zaza zasayinwa yiakhawunti kaJia Tan ekhankanyiweyo ngaphambili. He iposiwe kwiMastodon Kamva ngaloo mini, beqonda ukuba oku kufunyanisiweyo kwenzeke ngengozi kwaye kwakufuneka kubekho izinto ezininzi ezihambelanayo. Izimvo zabanye abasebenzisi zifanelekile ukufundwa. Umsebenzisi weGitHub i-thesameam (owaziwa ngokuba nguSam James) upapashe iGist entle Imibuzo Ebuzwa Rhoqo malunga nomnyango wangasemva we-xz-utils apho uhlaselo lushwankathelwe khona, ludibanisa nezinye uhlalutyo olunzulu umthwalo wohlaselo. Olu hlalutyo belunomdla kakhulu, kwaye lwasinceda ukuba siqonde ngcono inaliti, eyayichazwe kakuhle:- xz/liblzma: Inkcazo ye-Bash-stage ObfuscationUhlalutyo oluhle malunga nokususwa kwe-deobfuscation yi-injection script, "kwizigaba" ezine.
- Intambo eluhlaza okwesibhakabhaka kaFilippo Valsorda Uhlalutyo lomnyango ongasemva ngokwawo kwi-RSA_public_decrypt, olubonisa uhlobo lwawo: i-RCE, hayi i-auth bypass, kunye ne-gated (yamkela isitshixo sabucala sombhali kwaye ukuba akunjalo, ibuyela kwindlela eqhelekileyo yokuziphatha) / ayihlawuleki. Umbhali wayefuna ukungaziboni kakuhle ukuze angabhaqwa!
- Uhlalutyo lwe-XZ Backdoor ngu-@smx-smx (WIP) – Uhlalutyo olongezelelweyo lomnyango ongasemva (ndalahleka phantse ekuqaleni 😀)
- uxwebhu lwe-xz olungasemva lwewiki, olunye uhlalutyo lweskripthi sokufaka inaliti se-5.6.1.
Indlela esiphathwe ngayo esi siganeko
Inkcazo ka-Andreas Freund yayilumkile kuba, ngamazwi akhe:“Ngenxa yokubandakanyeka okubonakalayo kwe-upstream, andikaze ndixele ngempazamo ye-upstream. Njengoko bendicinga ekuqaleni ukuba yingxaki ethile ye-debian, ndithumele ingxelo yokuqala ku-security@...ian.org. Emva koko, ndixele ngengxaki ku-distros@. CISU-A waziswa ngokusasazwa.
Ngubani ophantsi kohlaselo?
Nokuba iakhawunti yeGitHub JiaT75 ibekwe emngciphekweni (khumbula ukuba iGitHub imisele i-2FA kutshanje) okanye umsebenzisi onetyala leakhawunti uye kwicala elibi. Kodwa kukho izizathu ezivakalayo zokucinga ngesongelo esiqhubekayo esiqhubekekayo (APT), mhlawumbi esixhaswa ngurhulumente, ngenxa yobuchule bohlaselo. Uphando olongezelelekileyo olwenziwe ziiarhente zokhuseleko lwe-intanethi kunye namapolisa luya kuxela … Olungeno kwiindaba ze-YCombinator Hacker malunga noJia Tan ikhanyisa "ngubani" kunye nomsebenzi wakhe. Icetyiswa! Inika ulwazi oluninzi malunga nendlela abantu ababi abazama ngayo ukukhohlisa abanye abasebenzisi, besebenzisa ubunjineli bezentlalo.“Kuyacaphukisa kakhulu - umbhali obonakalayo we-backdoor wayenxibelelana nam (rwmj) kangangeeveki ezininzi ezama ukufumana i-xz 5.6.x yongezwe kwiFedora 40 kunye ne-41 ngenxa “yeempawu zayo ezintsha ezintle”. Sisebenze naye ukulungisa ingxaki ye-valgrind (ekuvela ukuba ngoku ibangelwe yi-backdoor awayeyongeze). Kwafuneka sibalekise izolo ebusuku ukulungisa ingxaki emva kokwaphulwa kwe-embargo ngengozi. Ube yinxalenye yeprojekthi ye-xz iminyaka emi-2, esongeza zonke iintlobo zeefayile zovavanyo lwe-binary, kwaye ukuba ndinyanisekile ngolu nqanaba lobuchule ndingakrokrela nakwiinguqulelo ezindala ze-xz de ndifumane ubungqina obuchaseneyo.”
UJia Tan uthathe amanyathelo okuthintela ukulandelelwa: Kubonakala ngathi usebenzise iVPN (vpn.singapore.witopia.net) ukunxibelelana – nto leyo ilungile. Kwaye utshintsho oluninzi lubonakala luxhaswa zii-imeyile zexeshana, ezisetyenziswa kanye (ezivela kwiProtonMail kweli tyala) ezikhuthaza ukuba kudityaniswe utshintsho.
Umdlali weqonga usenokuba nenjongo yokungena nzulu ngakumbi, ukuya kwi-kernel yeLinux, njengonegalelo kwi i-xy-embedded Uhlalutyo lokuqala alufumananga bungqina bokuphuphuma kwesisu, njenganamhlanje.
Qaphela: enye Umbhali we-XZ ophantsi "uHans Jansen" (Umsebenzisi weGitHub “hansjans162”) ngu phantsi koqwalaseloIakhawunti yayo kwi-debian ngoku valiwe. Wenza uhlaziyo oluninzi kwiDebian Games ukuze afihle leyo wayeyifuna kwidebian/xz-utils, uhlaziyo oluya kwi-upstream 5.6.1 ukuze akhawulezise ukusasazwa kwe-backdoor ukuya i-debian/engazinzanga.
Esinokuthi, okwangoku, kukuba le yi-APT (engekaziwa okwangoku) esebenzisa iiakhawunti ezahlukeneyo, isebenza ubuncinane iminyaka emibini kweli phulo, kwaye isebenza ngomonde ukufaka i-RCE kwi-SSH.
Okwangoku, ungubani ongasemva kwe-"Jia Tan" akakaqinisekiswa. Akukho bungqina buthembekileyo kumntu othile, umbutho, okanye umdlali welizwe obuqinisekisiweyo esidlangalaleni, nto leyo eqinisekisa indlela esebenza ngayo indlela yokusebenza kwale ndoda.
Ngaba uhlaselo lwe-XZ olungasemva lwalunokuthintelwa?
Kunzima kakhulu.
Okokuqala, inxalenye yomnyango ongasemva ojoyiweyo yangena kwiifayile zovavanyo ezicinezelweyo ezazingasetyenziswa ziivavanyo. Ngokujonga emva, oko kunokuphakamisa ii-alamu ezithile (ezinomsindo), kodwa ngubani okhathalayo ngokujonga ukuba zonke iifayile zovavanyo zisetyenziswa ziivavanyo zokwenyani kwihlabathi lokwenyani? Okwesibini, inxalenye yomnyango ongasemva ojoyiweyo yangena kwiifayile ze-macro kwi-release tarballs, kwaye kunzima ukujonga ngesandla umahluko ngee-tarballs ezilindelekileyo. I-automation nayo iyinkimbinkimbi, njengoko isiphumo esilindelekileyo kwisakhiwo ngokwaso (kuye nabani na owaziyo ukuba i-automake/autoconf isebenza njani) kunzima ukuyila imodeli yokuhlalutya ukuba i-tarball yokwenyani iyahambelana nolindelo. Abanye bayibuzile as "Ukungafani kwee-tarballs kumthi we-git luphawu, aluyongxaki"Imvelaphi yee-tarballs ze-binary kwikhowudi yayo yomthombo yingxaki engasonjululwanga.
Udumo lomsebenzisi? Kaloku, iakhawunti yeJiaTan75 GitHub yayingenzi izinto zobuqhophololo ngokwexesha elidlulileyo commits. Yamiswa kuphela emva kokuba ubungqina buqokelelene, kodwa ukuya kuthi ga nge-29 kaMatshi yayingumsebenzisi oqhelekileyo owenza umsebenzi oqhelekileyo. Kaloku, ayiqhelekanga kangako. Kamva commits (lo, lo, lo, yaye lo eyalungisa ikhowudi yokuxhaphaza) yazama ukulungisa iimpazamo ze-valgrind kunye nokuqhekeka kwezinye iinkqubo, ngenxa yokwahluka ngoyilo lwe-stack olulindelwe yi-backdoor. Commit uphononongo lunokukubona oku, kodwa ngubani onomonde wokuhlalutya utshintsho kwifayile yovavanyo lwe-binary okanye isizathu sokwenyani sotshintsho kwiimpawu ze-GCC kwikhowudi yomthombo we-C?
Ngaba umntu kufuneka aphakamise ii-alamu xa esebenzisa i-SSH? login ithatha i-800 ms endaweni ye-300 ms? Mhlawumbi ngabantu abalumkileyo kuphela abaya kuyiqwalasela. UCicero uthe, "Ukurhawuzelela kokwasebutsheni; ubulumko bukwaluphala."
Iziseko zophuhliso ze-ifunc zongezwa ngoJuni 2023 ngu-“Hans Jansen” kunye no-“Jia Tan”. Le yeyokuqala commit ukongeza inkxaso ye-ifunc kwi-crc64_fast.c (kamva yasetyenziswa ukufaka i-backdoor). Iinyanga ngaphambi kokufaka ii-binary ze-backdoor kwiifayile zovavanyo!
Qaphela: Umbhali kunye commitBahlukile apha, kodwa oku kuqhelekile: ULasse Collin ngumgcini weprojekthi, kwaye udibanise utshintsho. Ude ambulele “uHans Jansen” …
Akukho mntu uveze inkxalabo ngaphambi kweposi ka-Andres Freund kunye ne-CVE eyenziwe yiRedHat. Ukuba ubona uluhlu lwezixhobo eziza kubamba oku, bayayibona into echaphazelekayo ngoku, Isikhundla sangaphambili.
Mhlawumbi eyona ndlela ilungileyo yokuthintela ivele kwindlela usasazo lweLinux olungazinzanga ngayo, kunye nendlela iinguqulelo ezingasebenzi kakuhle neziphuma ngayo igazi ezidlula kuphela kusasazo oluzinzileyo oluya ezantsi emva kwenkqubo ekhawulezileyo.
Izifundo Ezifundwe kwi-XZ bBackdoor Attack
Siqaphele indlela ekunzima ngayo ukuyibona ngenjongo iingcango zangasemva. Iingcango zangasemva kufuneka zithathwe njengengozi yangaphakathi, njengoko zityalwa ngabasebenzi bangaphakathi okanye ngeeakhawunti zangaphakathi ezisengozini. Kwaye abo bantu bathenjwa kakhulu. Kwaye xa ingcango yangasemva ityalwe kwizinto ezisasaziweyo, kwenza kube nzima ukuyibona.
Abanye ababhali abafana noKevin Beaumont ikhombe kwi isixokelelwano, nto leyo evula indawo enkulu yokuhlasela kweenkonzo zomntu wesithathu ukuya emnyango ongasemva. Yile nto umdlali ombi ayisebenzisileyo apha. I-Systemd ineebhola ezininzi zamehlo, kodwa i-XZ lithala leencwadi elingaziwayo phezulu kolu luhlu. "Xa umsinga ophezulu ungcolile, wonke umntu usela amanzi anetyhefu ngezantsi komlambo".
Isicelo sotshintsho olungahambelaniyo kwinkqubo ye ukulayisha ngokuguquguqukayo iilayibrari zoxinzelelo, eyayiza kususa ucango lwangasemva, yayisele idityanisiwe kwinkqubo kodwa ayikafiki. Ukuxhomekeka okongezelelweyo okuziswe yi-libsystemd kunokuba ngumthombo wobuthathaka, kwaye izolo esi sicelo sivuliwe.
A amagqabantshintshi kwi "xz: Khubaza i-ifunc ukulungisa ingxaki" commit inike ulwazi olucacileyo malunga nokuba singayibeka phi ingqwalasela ukuba sifuna ukuthintela loo nto (ndigxininisa kakhulu):
"Isifundo esifanele sisifunde njengoluntu siqinisekisa ngakumbi software supply chain security ngokupheleleyo, uphicotho-zincwadi lweenkqubo zokwakha ngaphaya kwekhowudi yomthombo kuphela. Njengokwaphulwa kweSolarWinds apho abahlaseli batshintshe uhlaziyo lwesoftware yesoftware yokubeka esweni imithombo evaliweyo yeSolarWinds.
FAQ
Ngaba i-XZ backdoor isengumngcipheko nanamhlanje?
Ininzi iqulethwe, kodwa ayiphelanga ngokupheleleyo. Ngo-Agasti 2025, abaphandi bafumanise ukuba ucango lwangasemva lusekho kwimifanekiso emininzi yeDebian Docker Hub, ephathwa yiDebian njengezinto zakudala ezingasebenziyo. Amaqela kufuneka aqinisekise ukuba awakhi kwimifanekiso esisiseko yakudala, engapakishwanga endaweni yokucinga ukuba ucango luka-2024 luvale ngokupheleleyo ucango.
