PLEASE IMMEDIATELY STOP USAGE OF ANY FEDORA RAWHIDE INSTANCES for work or personal activity. Fedora Rawhide will be reverted to xz-5.4.x shortly, and once that is done, Fedora Rawhide instances can safely be redeployed. Note that Fedora Rawhide is the development distribution of Fedora Linux, and serves as the basis for future Fedora Linux builds (in this case, the yet-to-be-released Fedora Linux 41).
At this time the Fedora Linux 40 builds have not been shown to be compromised. We believe the malicious code injection did not take effect in these builds. However, Fedora Linux 40 users should still downgrade to a 5.4 build to be safe. An update that reverts xz to 5.4.x has recently been published and is becoming available to Fedora Linux 40 users through the normal update system. Concerned users can force the update by following the instructions at https://bodhi.fedoraproject.org/updates/FEDORA-2024-d02c7bb266.
Under the right circumstances this interference could potentially enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely.
User recommendation For our openSUSE Tumbleweed users where SSH is exposed to the internet we recommend installing fresh, as it’s unknown if the backdoor has been exploited. Due to the sophisticated nature of the backdoor an on-system detection of a breach is likely not possible. Also rotation of any credentials that could have been fetched from the system is highly recommended. Otherwise, simply update to openSUSE Tumbleweed 20240328 or later and reboot the system.
Just a few days ago I've installed xz from nixpkgs-unstable on a machine (luckily not my node). How screwed am I? It came from binary cache tho, so configure was never invoked, well at least not on my machine
More info:
view on twitter.comIf you're running Ubuntu, seems like you may not be affected:
view on twitter.comMore info: https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
Most important parts
OpenSuse is even recommending reinstalling everything instead of just updating xz.
https://news.opensuse.org/2024/03/29/xz-backdoor/
https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27
https://www.nobsbitcoin.com/backdoor-in-xz-tools-used-by-most-linux-distros/
Have to admit hidding the backdoor in obfuscated compressed test data was a genius move
Just a few days ago I've installed xz from nixpkgs-unstable on a machine (luckily not my node). How screwed am I? It came from binary cache tho, so configure was never invoked, well at least not on my machine