Unveiling the xz Utils Backdoor which deliberately opens our SSH connections for RCAs

In the latest liblzma update, a trusted bad actor called 'JiaT75' implemented a backdoor which allows RCA calls to system() on ssh connections. Here I'm looking into the case and explaining how it works.

Links:

• AndresFreundTec on Mastodon: https://mastodon.social/@AndresFreundTec/112180083704606941
• openwall email: https://www.openwall.com/lists/oss-security/2024/03/29/4
• debian repo: https://salsa.debian.org/debian/xz-utils/-/blob/debian/unstable/m4/build-to-host.m4?ref_type=heads#L63
• Filippo Valsorda on bsky: https://bsky.app/profile/filippo.abyssdomain.expert/post/3kowjkx2njy2b ... https://www.youtube.com/watch?v=gyOz9s4ydho