Post #2092815

2024-03-29 17:10 UTC

I accidentally found a security issue while benchmarking postgres changes. If you run debian testing, unstable or some other more &quot;bleeding edge&quot; distribution, I strongly recommend upgrading ASAP. https://www.openwall.com/lists/oss-security/2024/03/29/4

Replies (3)

@AndresFreundTec@mastodon.social 2024-03-29 18:32

I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc. Profiled sshd, showing lots of cpu time in liblzma, with perf unable to attribute it to a symbol. Got suspicious. Recalled that I had seen an odd valgrind complaint in automated testing of postgres, a few weeks earlier, after package updates. Really required a lot of coincidences.

Open ##2096818
@CyrilBrulebois@mamot.fr 2024-03-29 17:55

@AndresFreundTec This is incredible work, thank you so much.

Open ##2096822
@stsquad@mastodon.org.uk 2024-03-29 18:13

@AndresFreundTec Excellent analysis and lucky it got spotted so early. The implications are rather terrifying though, it looks like a long game to subvert and compromise an upstream project. We can't assume this is the first or only attempt so far.

Open ##2096826