cyclone-github / scripts Goto Github PK

Arch core started to distribute xz version 5.6.1-3 this morning: https://archlinux.org/packages/core/x86_64/xz/

The version leads to a false positive in the script, as it is a patched version but results in VULNERABLE.

This script appears to only detect 5.6.0 as vulnerable.

https://github.com/cyclone-github/scripts/blob/main/xz_cve-2024-3094-detect.sh#L48

However, versions 5.6.0 and 5.6.1 are both vulnerable.

On my ARM64 Manjaro laptop, the script says that liblzma can not be found. That's because sshd doesn't use liblzma in this case. However, liblzma is still vulnerable and it should be reported.

This patch fixes it for me:

--- xz_cve-2024-3094-detect.sh.orig	2024-03-30 11:53:33.460349832 +0100
+++ xz_cve-2024-3094-detect.sh	2024-03-30 11:52:27.854102624 +0100
@@ -25,6 +25,12 @@
 sshd_path=$(whereis -b sshd | awk '{print $2}')
 path=$(ldd "$sshd_path" 2>/dev/null | grep -o '/.*liblzma[^ ]*' | head -1)
 
+# or find path to liblzma used by xz
+if [ -z "$path" ]; then
+    xz_path=$(whereis -b xz | awk '{print $2}')
+    path=$(ldd "$xz_path" 2>/dev/null | grep -o '/.*liblzma[^ ]*' | head -1)
+fi
+
 if [ -z "$path" ]; then
     echo
     echo "Probably not vulnerable (liblzma not found)"

Thanks,
Simon

• path=$(ldd "$sshd_path" 2>/dev/null | grep liblzma | awk '{print $3}' | head -n 1)

can be optimized a bit and remove an unneeded pipe:

path=$(ldd "$sshd_path" 2>/dev/null | grep -o '/.*liblzma[^ ]*' | head -1)

This'll probably not be as easy to use as the way you're currently doing it:
$(xz --version | head -n1 | awk '{print $4}')
Invokes xz, to get the version.

I's probably better to not invoke xz itself, but ask the package manager. For Debian based systems, this would be:
$(dpkg -l | grep xz | awk '{print $3}')

on an Arch system the script is checking only the version of xz and reporting vulnerable if it's 5.6.0/5.6.1, however Arch pushed a new version which is 5.6.1-2 (supersedes 5.6.1-1) which is (hopefully) not vulnerable, though the script says it is

so they say.

https://jmmv.dev/2023/07/ldd-untrusted-binaries.html
https://lore.kernel.org/linux-man/[email protected]/t/#u