From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from moene.org (84-86-97-173.fixed.kpn.net [84.86.97.173]) by sourceware.org (Postfix) with ESMTPS id 83A8E3847718 for ; Wed, 3 Apr 2024 18:36:03 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 83A8E3847718 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=moene.org Authentication-Results: sourceware.org; spf=none smtp.mailfrom=moene.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 83A8E3847718 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=84.86.97.173 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1712169365; cv=none; b=USJJmMb9GJKFeHVBJD9RiZZkhTyOOYC/gsRV1fc/+plw6zbz1fBwYTooQzLVsuziz3OpQ9Qn5caZF8fKml90di5TKzV9dK37/es9UpsJ0pIYu5xthRSca0uYADGTO1BrGiiVK1i1fpGR/jD6UvaYv7oCAgjqgtHYQREzdhgHBLA= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1712169365; c=relaxed/simple; bh=dQ6KZFyA1ju1jF7syS/KfET83aQ+VqFeF7csZaD9SW4=; h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From; b=tN0su+epyaxWHyRcF6uzrXWve01YWHYfDlnCFNHHz6P1p2uiq8HcJqVPQZE+/wsN25WzUotOkdeRzetdNRltiM6dL+AR1f4f2Bcmk1cXK9Q/rSZz9nMGaOQdqc5uSoh7SFiX7tHvNxLKjmv2N5Ejhg4mBG7V13sUSGlkI0dGrFQ= ARC-Authentication-Results: i=1; server2.sourceware.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=moene.org; s=key; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:From:References: Cc:To:Subject:MIME-Version:Date:Message-ID:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=Da7iHvXK4WOUq38RgaenOkKJeHFjgJNBY/c+xy1Wuo8=; b=YDQzQKbbz7/NrannZeFnGEHdVv fWS9O5lFQG02n4cfvpRyaB3LXxNbi16EqOTiNz3PX8xms/rsU5XqcJRpZKp4U6IF5TRS7owMvzs2u qxsYzY9Na/Umg3t2/DE47NunaePUTORun6bIXmWPx1zC68YEtr58jzewU+eSvPZbSpysc31NREbdc PVlzHTITVjpbXyhYWE75wZaeYMANuRGmytazmyCEudeNXWtmGXQVQsRrrwn36UtoRFQTWWibqMxcC UmKROsahFUSdjStRkrH704K94W9Clm6ndCgWcPZD5VW5AdfDhbHXdetELESY81hWM6J82ZaLNGMyc ZcutUGvw==; Received: from localhost ([127.0.0.1]) by moene.org with esmtp (Exim 4.97) (envelope-from ) id 1rs5Ss-00000003a6O-3K1y; Wed, 03 Apr 2024 20:36:02 +0200 Message-ID: Date: Wed, 3 Apr 2024 20:36:01 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: Sourceware mitigating and preventing the next xz-backdoor Content-Language: en-US To: Ian Lance Taylor Cc: gcc@gcc.gnu.org References: <20240329203909.GS9427@gnu.wildebeest.org> <20240401150617.GF19478@gnu.wildebeest.org> From: Toon Moene Organization: Moene Computational Physics, Maartensdijk, The Netherlands In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-2.3 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_NONE,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: On 4/3/24 20:25, Ian Lance Taylor wrote: > Note that the attack really didn't have anything to do with > compressing data. The library used an IFUNC to change the PLT of a > different function, so it effectively took control of the code that > verified the cryptographic key. The only part of the attack that > involved compression was the fact that it happened to live in a > compression library. And it wouldn't matter whether the code that > verified the cryptographic key was run as root either; the effect of > the attack was to say that the key was OK, and that sshd should > execute the command, and of course that execution must be done on > behalf of the requesting user, which (as I understand it) could be > root. Ah, OK - that's what I missed. Does your explanation mean that - if, as I do in my sshd config file - you *forbid* root access via sshd in *any* way, you wouldn't be vulnerable ? Thanks, -- Toon Moene - e-mail: toon@moene.org - phone: +31 346 214290 Saturnushof 14, 3738 XG Maartensdijk, The Netherlands