@Migueldeicaza @davew More details specifically on Crowdstrike moving its macOS implementation off of kernel and into user space (in 2020):

https://www.crowdstrike.com/blog/crowdstrike-supports-new-macos-big-sur/

@mjg59 @james Probably relates to this Redhat issue - https://access.redhat.com/solutions/7068083

Apparently their latest releases still ship with 5.14, which they apparently maintain as their own branch (mainline considered it EOL back in November 2021).

Do wonder WTF there rationale is for that one.

@christian @brenns10

Does it fit in a toot?

#! /bin/bash

set -u

# find path to liblzma used by sshd
path="$(ldd $(which sshd) | grep liblzma | grep -o '/[^ ]*')"

# does it even exist?
if [ "$path" == "" ]
then
echo probably not vulnerable
exit
fi

# check for function signature
if hexdump -ve '1/1 "%.2x"' "$path" | grep -q f30f1efa554889f54c89ce5389fb81e7000000804883ec28488954241848894c2410
then
echo probably vulnerable
else
echo probably not vulnerable
fi