Ultimately this attempt failed because the malicious code was discovered before any mainstream Linux distributions likely to be in use in target institutions incorporated the change, but the potential impact was insanely wide.
I can confirm that the XZ Utils backdoor did make it into both Gentoo Linux and Fedora. I classify these as mainstream as they're likely development distributions for many people, including myself (although, I also use the former as a production distribution). Developers of both distributions were also tricked into fixing the backdoor; both Sam from Gentoo Linux, and one or more Fedora developers, unknowingly assisted in the patching of the backdoor to make it work. What's ironic is that one of the patches fixed an
actual bug in GCC, so it was kept even after discovery of the backdoor.
The advantage of running a so-called "rolling release" distribution, rather than a "stable" or "LTS" distribution, is rapid patching of bugs, including security vulnerablilities, so it's normal for these packages to be included quickly after release. While it made it into Fedora Beta, not Fedora release versions, Beta users were likely protected by an
unrelated patch disabling glibc's
IFUNC functionality. As for Gentoo Linux, you had to be running "unstable" packages via the specific keyword(s) (rolling, pulling latest versions from upstream sources), such as
~amd64, to get the backdoored XZ Utils version. Gentoo Linux was not affected, along with Arch Linux (possibly others) due to not using Debian- and Red Hat-specific patches.
Personally, I had both of the backdoored versions installed; however, I was saved by musl, which doesn't include glibc's non-standard
IFUNC functionality (pretty-much a developer feature which doesn't really have a place on a production machine). This is exactly one of the many reasons I avoid glibc on systems which don't have a hard requirement on it (typically, gaming and AI systems require it). I also run Gentoo Linux, as stated, which doesn't include the Debian or Red Hat patches required for the backdoor to hook into sshd (systemd is another bloated mess I avoid for the same reasons). Finally, as with the previous point, I run OpenRC as my init system, which doesn't have the systemd issue of pulling in liblzma as a dependency for an absurd reason. The only condition met by my systems was the architecture being amd64, which wasn't enough for it to function. People may say it was luck, but this is exactly the reason I use this specific setup in the first place.
Ubuntu also pulled it, but it was never released and they rebuilt all of their packages as a precaution, in case they were linked to the backdoored XZ Utils version; this delayed the release of the newer Ubuntu version.
It is very possible that developers of the more-mainstream distributions, including Debian and Ubuntu, had the backdoor running on their development and build systems, while the entire IPv4 address-space was being scanned. It's impossible to know if anything was tampered with in that way before systems were cleaned of the backdoor.
