Ironclad - News
Ironclad distributions and the xz-utils backdoor
Item posted by Klaus Schneider <streaksu> on Sat 30 Mar 2024 04:27:06 AM UTC.
xz-utils, a popular set of data compression software tools used by tons of software and operating systems has been actually, unbeknownst to us, maintained by a malicious actor for the past 2+ years, and a backdoor (and potentially more) have been added to it.
Ironclad itself does not use xz internally nor distributes xz tarballs, so the kernel itself is not affected whatsoever nor needs infected software to be built.
Some Ironclad distributions ship affected versions, but we are not aware of any malicious code being exploitable in Ironclad userlands, given how targeted the known malware was to Linux systems. This might vary depending on the makeup of the distribution in question and with future disclosures. Distribution maintainers should remain vigilant to further developments and take action against compromised versions of xz-utils, especially when used along with ssh and other cryptography-related programs.
One can read more about the vulnerability at:
- The original vulnerability report.
- An informative summary by thesamesam on github.
Powered by Savane 3.14-8aba.
Corresponding source code