This week, we dive into a new SSH xz backdoor discovered in a popular Linux distribution and how to protect your organization from an HTTP/2 CONTINUATION Flood.
On Friday, March 29, Microsoft developer Andres Freund posted that he had discovered a backdoor in a software library called 'liblzma', part of the 'xz Utils' package used by most Linux distributions.
Research into the backdoor revealed that successful execution of the malicious code placed in the xz Utils software manipulates sshd, the executable that makes SSH connections.
Once this is triggered, a threat actor possessing a specific encryption key could place arbitrary code in an SSH login certificate, upload it, and execute the code on the backdoored device.
The backdoor was placed into the code by a user going by JiaT75 (Jia Tan), who began contributing to the open source project starting in 2021.
Thankfully, this discovery took place before the backdoored library was rolled out to stable releases of Linux. The backdoor vulnerability is now tracked as CVE-2024-3094.
xz Utils is a compression utility found in most Linux distributions that provides lossless data compression.
Although this library is not directly a part of OpenSSH, based on functionality of most Linux distributions such as Debian, xz Utils is linked to OpenSSH via systemd (loads services on system bootup) and sshd (the server process for OpenSSH), which then allows xz Utils to control sshd.
Microsoft threat researcher Thomas Roccia created an excellent infographic showing how this utility was abused to create the back door.
The Github commits posted in February for versions 5.6.0 and 5.6.1 of xz Utils contain the backdoor. While this issue was caught relatively early, the malicious version of the software did get pushed so several "bleeding edge" Linux versions:
Aside from the above list of affected Linux versions, Linux administrators can determine the version of xz Utils running on the system by using either of the following CLI commands:
This resource also tracks which versions of the utility are current for each Linux distribution. If a backdoored version is discovered on a host, it is recommended to immediately downgrade the utility to a previous stable version, such as 5.4.6.
Additional Resources
In 2015, the HTTP/2 protocol was published to help facilitate the demand for greater website performance.
The protocol includes features such as reduced overhead via header compression, multiplexing which allows multiple requests and responses with a single connection, and binary framing for more efficient data transmission. In these frames, researcher Barket Nowotarski discovered an "out of memory" vulnerability that can lead to denial of service attacks on a web server with a single HTTP/2 connection.
In HTTP/2, there are two frame types relevant to this vulnerability.
The HEADERS frame allows for the sending of both request and response headers. This frame has a maximum size that is allowed, and if the frame is larger than the maximum size, it is split into additional frames called CONTINUATION frames. Once the end of the header data is reached, the final CONTINUATION frame is meant to have an END_HEADERS flag signifying the end of the data stream.
What Barket discovered is if an HTTP/2 connection is made, and the stream sends HEADERS and CONTINUATION frames without ever sending the END_HEADERS flag, this creates an effective infinite stream of headers that eventually causes the webserver to run out of memory, as it eventually does not have the resources to parse and store all of the data sent.
The infographics below from Barket's blog do a great job of illustrating the bug:
Fig. 1 - Standard data stream where last CONTINUATION frame includes the END_HEADERS flag
Fig. 2 - Infinite stream where no CONTINUATION frames contain the END_HEADERS flag
Since this vulnerability affects HTTP/2 at the protocol level, multiple CVEs have been issued based on what platforms have implemented HTTP/2:
Per CERT-CC, vendors and HTTP/2 libraries that have confirmed they are impacted by these vulnerabilities are Red Hat, SUSE Linux, Arista Networks, Apache HTTP Server Project, nghttp2, Node.js, AMPHP, and the Go Programming Language.
Due to the ease of exploitation and the detail with which this vulnerability has been described in research, this vulnerability has a high likelihood of exploitation. Administrators are urged to immediately apply the appropriate patches based on their web server technology stack.
Additional Resources
Stay updated with PacketWatch's cybersecurity content by subscribing to our monthly newsletter, delivered to your inbox on the last Tuesday of the month.
PacketWatch publishes this report and other cybersecurity threat intel to the security community for free via our blog.
If you want personalized threat intel, contact us today to learn about our enterprise threat intelligence services.
Note: We've also enriched our original threat intelligence report by including resources from our partner in cyber threat intelligence, SOCRadar. You may need a registered SOCRadar account to view their threat intelligence resources.
DISCLAIMER
Kindly be advised that the information contained in this article is presented with no final evaluation and should be considered raw data. The sole purpose of this information is to provide situational awareness based on the currently available knowledge. We recommend exercising caution and conducting further research as necessary before making any decisions based on this information.