diff options
| author | Xe Iaso <me@xeiaso.net> | 2024-03-29 14:57:53 -0400 |
|---|---|---|
| committer | Xe Iaso <me@xeiaso.net> | 2024-03-29 14:57:53 -0400 |
| commit | 646509045848a0495ff0f4779b8a8e3e5968ffa1 (patch) | |
| tree | 575de993eb0fbb7fb71d7089fac23ad353a24d04 | |
| parent | 472fb74ece2d8a1f6df7fb4ffc6db8c7c43b81f7 (diff) | |
| download | xesite-646509045848a0495ff0f4779b8a8e3e5968ffa1.tar.xz xesite-646509045848a0495ff0f4779b8a8e3e5968ffa1.zip | |
fix a suggestion from sam_ on IRC
Signed-off-by: Xe Iaso <me@xeiaso.net>
| -rw-r--r-- | lume/src/notes/2024/xz-vuln.mdx | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lume/src/notes/2024/xz-vuln.mdx b/lume/src/notes/2024/xz-vuln.mdx index 93fb52a..d27a1c0 100644 --- a/lume/src/notes/2024/xz-vuln.mdx +++ b/lume/src/notes/2024/xz-vuln.mdx @@ -15,7 +15,7 @@ The [xz/liblzma project](https://github.com/tukaani-project/xz) has released ver The combination of this and patches made by some distributions to the interactions between liblzma, libsystemd, and sshd have resulted in a situation where an attacker can compromise a system by sending a malicious payload to an sshd server. -We are lucky. This only affects AMD64 Linux systems. The vulnerability is in a specific RSA function. The exploit is in the wild. This is also a very new version of xz/liblzma, so it is not widely deployed yet. This is also unlikely to affect anything other than Glibc (because of glibc IFUNC support), so if you use [musl](https://musl.libc.org/) or another libc implementation, you are likely safe. +We are lucky. This only affects AMD64 Linux systems. Currently, incomplete analysis of the vulnerability suggests that this only targets a specific RSA function used in sshd. The exploit is in the wild. This is also a very new version of xz/liblzma, so it is not widely deployed yet. This is also unlikely to affect anything other than Glibc (because of glibc IFUNC support), so if you use [musl](https://musl.libc.org/) or another libc implementation, you are likely safe. If you are using a distribution that has not yet released xz 5.6.0 or 5.6.1, you are likely safe. |
