Hall of FameAndres Freund20248 min readpostmortemadvanced
The xz backdoor disclosure
Summary
Upstream xz 5.6.0/5.6.1 tarballs were compromised with an obfuscated script that modifies liblzma to inject a backdoor, which activates on specific x86_64 Linux builds and slows SSH logins. The issue is reproducible, detectable via source checks, and mitigated by avoiding the tainted releases or rebuilding from a clean source.
- xz 5.6.0/5.6.1 upstream tarballs embed an obfuscated configure script that patches liblzma/Makefile to inject malicious code.
- The payload only runs on x86_64 Linux builds using gcc and GNU ld, and when built as a Debian/RPM package, targeting sshd via libsystemd.
- When active, the backdoor slows SSH logins by 2‑3× and can execute arbitrary shell commands through crafted .xz files.
- Detection: look for the extra line in build-to-host.m4 and the presence of tests/files/bad-3-corrupt_lzma2.xz in the source tree.
Security engineers and distro maintainers must know the supply‑chain breach because it enables remote code execution in widely used SSH services.
7/10
