CVE-2024-3094

Name of the Vulnerable Software and Affected Versions xz versions 5.6.0 through 5.6.1

Description Malicious code was discovered in the upstream tarballs of xz. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file within the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against it to intercept and modify data interactions. Specifically, the backdoor targets the sshd process by replacing crc32 resolve() and crc64 resolve() functions and establishing a hook in the dynamic linker to replace the RSA public decrypt function. This allows a remote attacker to execute arbitrary code during SSH login. The exploitation is observed on x86-64 Linux systems built with gcc and the gnu linker, provided certain environment conditions are met, such as the absence of the TERM environment variable and the presence of LANG.

Recommendations For versions 5.6.0 through 5.6.1, downgrade to a known non-vulnerable version of xz. As a temporary mitigation, restrict the use of the liblzma library in sensitive services until the system is downgraded.