CVE-2024-3094

Name of the Vulnerable Software and Affected Versions XZ Utils versions 5.6.0 through 5.6.1

Description Malicious code was discovered in the upstream tarballs of xz. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified library that can be used by any software linked against it to intercept and modify data interactions. Specifically, the backdoor targets the OpenSSH daemon (sshd) by hooking the RSA public decrypt() function, allowing a remote attacker to bypass authentication and gain root-level access. The exploitation process involves replacing crc32 resolve() and crc64 resolve() functions with code that calls get cpuid() and parses symbol tables in memory. This compromise is a software supply chain attack where a malicious maintainer inserted the backdoor over a period of two years.

Recommendations Downgrade to XZ Utils version 5.4.6 or earlier for versions 5.6.0 through 5.6.1. As a temporary mitigation, restrict outbound SSH connectivity to prevent lateral movement. Isolate systems that compiled or deployed the affected versions. Audit build logs and installed versions for malicious object injections.