Homebrew
brew install xz installs the outdated version 5.4.6 instead of 5.6.1 #5243
-
Output of
|
Beta Was this translation helpful? Give feedback.
Replies: 12 comments 30 replies
-
|
This is intentional as 5.6.x is untrusted: https://www.bleepingcomputer.com/news/security/red-hat-warns-of-backdoor-in-xz-tools-used-by-most-linux-distros/ (see https://www.openwall.com/lists/oss-security/2024/03/29/4 for technical details) To be clear: we don't believe Homebrew's builds were compromised (the backdoor only applied to deb and rpm builds) but 5.6.x is being treated as no longer trustworthy and as a precaution we are forcing downgrades to 5.4.6. |
Beta Was this translation helpful? Give feedback.
-
|
In the Debian target that everyone knows about: The So the question I have is: how did Homebrew make this, exactly? Straight from the published GitHub repo? If so, then Homebrew was always fine, well... I don't think I want Jia's "enhancements" anymore or anything else he touched, and I think most people are thinking the same. Anyway: a ton of shit in the payload It's worth a look anyway to run this down, because maybe he did have plans for an BSD+arm64 variant. He certainly was quite aware of libs like Capsicum that were linked and used in EDIT: I only brought this up because I don't know the build process brew uses but I did search around; pulling from the origin repo to build direct absolutely would have never brought in/unpacked the But that was for this one SCA... a discussion still needs to be had about future-mal that may come down the pike that specifically goes after BSD+arm64. Or any arm64, what have you. |
Beta Was this translation helpful? Give feedback.
-
|
The RE effort so far is revealing that the exploit intended to weaken the RSA keycheck verification to look for a certificate-style key that's host-specific which the attacker can later present a pubkey and payload for and be allowed in. As in: it's truly a real backdoor. Here's some more detail about that part of the exploit, including a honeypot which can be setup to look for https://github.com/amlweems/xzbot/tree/main?tab=readme-ov-file#backdoor-format |
Beta Was this translation helpful? Give feedback.
-
|
All of the above is true at the time it was written, however release 5.6.2 was published May 29th after removal of the backdoor code and a full audit of the perpetrator's commits. It should be safe to roll forward now. |
Beta Was this translation helpful? Give feedback.
-
|
There's an open PR to update to the new release. Please contribute if you're able to fix any of the issues: Homebrew/homebrew-core#174378 |
Beta Was this translation helpful? Give feedback.
-
|
We are now shipping xz 5.6.2. |
Beta Was this translation helpful? Give feedback.
-
|
thank You! |
Beta Was this translation helpful? Give feedback.
-
|
Question: Shouldn't the dangerous After PROMPT> ls -l ~/Library/caches/homebrew | grep xz
lrwxr-xr-x 1 neoneye staff 112 Mar 30 00:37 xz--5.4.6 -> downloads/a8def111ef35d2c9d46e56ff2c6c7b623b61be0f395014454e9f11db2db16981--xz--5.4.6.arm64_sonoma.bottle.tar.gz
lrwxr-xr-x 1 neoneye staff 112 Mar 12 21:29 xz--5.6.1 -> downloads/0e0aec6661183ecb640ab65fdea4d5387cd8029dbe702b0b4801030e148df690--xz--5.6.1.arm64_sonoma.bottle.tar.gz
lrwxr-xr-x 1 neoneye staff 105 Mar 30 00:37 xz_bottle_manifest--5.4.6 -> downloads/b2cc4077807c100af6e0253f51d186f187ff55165638cbe3a4aa16d1c4762660--xz-5.4.6.bottle_manifest.json
lrwxr-xr-x 1 neoneye staff 105 Mar 12 21:31 xz_bottle_manifest--5.6.1 -> downloads/bc72ad1aed6fc861afaf3fd0af8266ea2913cb871cfdcbeef0c228afb9826c72--xz-5.6.1.bottle_manifest.jsonAfter the PROMPT> xz --version
xz (XZ Utils) 5.4.6
liblzma 5.4.6My config PROMPT> brew config
HOMEBREW_VERSION: 4.2.15
ORIGIN: https://github.com/Homebrew/brew
HEAD: 92a4311868322188478d7a90511ec0e8e6b0d7df
Last commit: 5 days ago
Core tap JSON: 29 Mar 23:36 UTC
Core cask tap JSON: 29 Mar 23:36 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_EDITOR: /Users/neoneye/bin/mate -w
HOMEBREW_MAKE_JOBS: 10
Homebrew Ruby: 3.1.4 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.1.4/bin/ruby
CPU: 10-core 64-bit arm_firestorm_icestorm
Clang: 15.0.0 build 1500
Git: 2.39.3 => /Applications/Xcode.app/Contents/Developer/usr/bin/git
Curl: 8.1.2 => /usr/bin/curl
macOS: 14.1.2-arm64
CLT: 15.3.0.0.1.1708646388
Xcode: 15.3
Rosetta 2: false |
Beta Was this translation helpful? Give feedback.
-
|
The second commit in Homebrew/brew#16977 should fix the need for the |
Beta Was this translation helpful? Give feedback.
-
|
I run |
Beta Was this translation helpful? Give feedback.
-
|
If you want real solution, compile your projects from source. I have never used brew. |
Beta Was this translation helpful? Give feedback.
-
|
@webfolderio What a place to put that as an answer to a problem lmao. |
Beta Was this translation helpful? Give feedback.
-
|
irony on |
Beta Was this translation helpful? Give feedback.
-
|
brew info xz 这些命令跑完基本就回退了 |
Beta Was this translation helpful? Give feedback.
-
|
You must run |
Beta Was this translation helpful? Give feedback.
-
Downgrading xz (compiled, not bottled) on unsupported macOS 11 Big Sur - Seems to workbrew update
brew info xz
brew cleanup xz --prune=0
brew reinstall xz
brew cleanup
brew info xz
xz --version
|
Beta Was this translation helpful? Give feedback.
-
|
thanks @porg |
Beta Was this translation helpful? Give feedback.
-
This is still referencing the compromised subdoman xz.tukaani.org which the attacker Jia Tan controls. The original URL was tukaani.org/xz which was controlled by Lasse Collin. Here's his message confirming that the attacker controlled the xz subdomain: https://tukaani.org/xz-backdoor/ Here's the attacker asking oss-fuzz to change the url from tukaani.org/xz to xz.tukaani.org: https://twitter.com/WhichbufferArda/status/1773829481645457798 |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
I'm sorry I don't know where the URL in |
Beta Was this translation helpful? Give feedback.
-
|
According to https://tukaani.org/xz-backdoor/:
We will update the homepage once a new one emerges. There is no harm in having that dead link until upstream provides a new one. |
Beta Was this translation helpful? Give feedback.
-
|
Meanwhile I think there's a little audit proof which can be done via macOS Terminal: { find /usr/local/lib -maxdepth 2 -iname "*liblzma*" 2>/dev/null | while read -r liblzma_path; do
hexdump -ve '1/1 "%.2x"' "${liblzma_path}"; done; } \
| grep 'f30f1efa554889f54c89ce5389fb81e7000000804883ec28488954241848894c2410'Adaption to macOS of the following source: I've first downgraded to 5.4.6, now the output is "nothing". If it finds the grep'ed string the installed version is vulnerable?! Thank you @porg for the downgrade instructions. Also it should be possible to compare ssh connections (please do not connect to other machines!): Observed requirements for the exploit:
-- if I understand it correctly the list could be extended for macOS by: --
Source: Or am I completely misunderstand this backdoor? |
Beta Was this translation helpful? Give feedback.
-
|
There's also conditions for it to actually make it into the binary: https://www.openwall.com/lists/oss-security/2024/03/29/4/1. The understanding of that is why it seems to be deb and RPM specific. ifuncs are also not supported on macOS. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for your downgrade instructions! @porg |
Beta Was this translation helpful? Give feedback.
-
|
@Bo98 I have a question just for my understanding of the brew info command. Does that mean the current formula from where I last updated brew is still referencing to the malicious version upstream, but I have the safe version installed? Because I have read several threads were people were using brew info xz to determine their version, but the installed version might actually be different than the first line of the output. |
Beta Was this translation helpful? Give feedback.
-
|
When you update Homebrew, you get a local copy of the version information ("Core tap JSON" in The path is the version you actually have installed. It's possible to have multiple, in which case the active one has a So in your case, you have xz 5.4.6 installed. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the response! :) As a suggestion: It might be useful to highlight the installed version or add something like |
Beta Was this translation helpful? Give feedback.
-
|
Wow! Thanks to Homebrew's swift action, my PC was saved! Truly appreciate the quick and careful response to ensure our systems stay secure. |
Beta Was this translation helpful? Give feedback.
-
|
There are some reverse engineered steps by Kaspersky: The latest commit by LiaT75 is: tukaani-project/xz@af071ef Commits for changes to xz on homebrew (to re-check yourself that xz wasn't downloaded via https:// xz . tukaani . org: But first off all:
So we should be 99,9% save even if we installed the vulnerable version of 5.6.0 to 5.6.1. Reverting to an earlier version is still advisable. |
Beta Was this translation helpful? Give feedback.
and others
This is intentional as 5.6.x is untrusted: https://www.bleepingcomputer.com/news/security/red-hat-warns-of-backdoor-in-xz-tools-used-by-most-linux-distros/ (see https://www.openwall.com/lists/oss-security/2024/03/29/4 for technical details)
To be clear: we don't believe Homebrew's builds were compromised (the backdoor only applied to deb and rpm builds) but 5.6.x is being treated as no longer trustworthy and as a precaution we are forcing downgrades to 5.4.6.