I accidentally found a security issue while benchmarking postgres changes.

If you run debian testing, unstable or some other more "bleeding edge" distribution, I strongly recommend upgrading ASAP.

https://www.openwall.com/lists/oss-security/2024/03/29/4

oss-security - backdoor in upstream xz/liblzma leading to ssh server compromise

I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc. Profiled sshd, showing lots of cpu time in liblzma, with perf unable to attribute it to a symbol. Got suspicious. Recalled that I had seen an odd valgrind complaint in automated testing of postgres, a few weeks earlier, after package updates.

Really required a lot of coincidences.

One more aspect that I think emphasizes the number of coincidences that had to come together to find this:

I run a number "buildfarm" instances for automatic testing of postgres. Among them with valgrind. For some other test instance I had used -fno-omit-frame-pointer for some reason I do not remember. A year or so ago I moved all the test instances to a common base configuration, instead of duplicate configurations. I chose to make all of them use -fno-omit-frame-pointer.

Afaict valgrind would not have complained about the payload without -fno-omit-frame-pointer. It was because _get_cpuid() expected the stack frame to look a certain way.

Additionally, I chose to use debian unstable to find possible portability problems earlier. Without that valgrind would have had nothing to complain.

Without having seen the odd complaints in valgrind, I don't think I would have looked deeply enough when seeing the high cpu in sshd below _get_cpuid().

@AndresFreundTec wondering whether Debian also finally decided to also add frame pointers led me to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=767756 which was created by you! (10 years ago, and still open…)
#767756 - glibc: Consider providing a libc build compiled with -fno-omit-frame-pointer to help with profiling - Debian Bug report logs

@praseodym Hah. I've apparently been doing this stuff for a while.

@AndresFreundTec I see you’ll be at Oxide and Friends, super cool! Unfortunate a bit too late for me (2am) so I’ll listen to it as a podcast.

I’m trying to understand the context a bit better: how did you get Debian with -fno-omit-frame-pointer, did you compile it yourself? Or did the valgrind errors came from PostgreSQL builds with liblzma linked to it?

@praseodym I do not have all of Debian built with -fno-omit-frame-pointer (although I do have a ~10 year old bug report about wanting a glibc package with frame pointers), just postgres. The errors came from postgres being built with libsystemd support, which in turn linked to liblzma.