{"status":"success","data":{"id":"CVE-2024-3094","slug":"cve-2024-3094-xz-utils-supply-chain-backdoor","title":"XZ Utils / liblzma Malicious Code Supply Chain Backdoor","summary":"Sophisticated malicious backdoor inserted into upstream tarballs of XZ Utils (liblzma) compromising SSH authentication on Linux systems.","description":"Malicious code was discovered in the upstream tarballs of XZ Utils starting with version 5.6.0. Through complex obfuscation techniques involving test files and M4 macros, the backdoor injects hooks into OpenSSH's authentication routines (specifically `RSA_public_decrypt`), allowing a threat actor with a specific private key to bypass SSH authentication and execute arbitrary commands with root privileges.","severity":"CRITICAL","cvss_score":10,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_metrics":{"scope":"CHANGED","integrity":"HIGH","attackVector":"NETWORK","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"NONE"},"epss_score":0.985,"epss_percentile":0.997,"cisa_kev":true,"cisa_date_added":"2024-04-01T00:00:00.000Z","cisa_due_date":"2024-04-22T00:00:00.000Z","ransomware_campaign":null,"threat_actors":["Jia Tan / State-sponsored advanced actor"],"exploit_status":"weaponized","cwes":[{"id":"CWE-506","name":"Embedded Malicious Code"},{"id":"CWE-829","name":"Inclusion of Functionality from Untrusted Control Sphere"}],"affected_vendors":["Tukaani Project","Debian","Fedora","openSUSE","Arch Linux","Kali Linux"],"affected_products":[{"cpe":"cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*","vendor":"Tukaani","product":"XZ Utils / liblzma","fixed_version":"5.6.2 (or downgrade to 5.4.6)","affected_versions":"5.6.0, 5.6.1"}],"ai_analysis":{"sigma_rule":"title: Detection of Vulnerable XZ Utils 5.6.x\nstatus: critical\nlogsource:\n  product: linux\ndetection:\n  selection:\n    package_version|startswith:\n      - '5.6.0'\n      - '5.6.1'\n  condition: selection","analyzed_at":"2026-10-28T09:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"The most sophisticated open-source supply chain attack in history. A multi-year persona embedded a cryptographic master-key backdoor inside liblzma that hooked sshd to give attackers unauthenticated root shell access.","detection_guidance":"Run `xz --version` and check for 5.6.0 or 5.6.1. Inspect glibc dynamic symbol tables with `readelf` on `liblzma.so` to detect anomalous IFUNC references.","mitigation_playbook":["Downgrade xz-utils and liblzma to 5.4.x (e.g. 5.4.6) across all systems.","Audit software build pipelines and artifact checksums against verified trusted upstream git commits.","Implement binary integrity checks and enforce strict supply chain provenance verification (SLSA Level 3+)."],"technical_root_cause":"The attacker orchestrated a multi-year social engineering campaign to gain co-maintainer status on XZ Utils. Obfuscated shell scripts inside `tests/` archives extracted an ELF object file during build time, which modified `liblzma.so` symbols via GNU indirect functions (IFUNC), hooking OpenSSH's RSA verification routines.","exploitation_mechanism":"When a target sshd service initializes, the malicious liblzma hooks `RSA_public_decrypt`. When an SSH client attempts authentication presenting a signature encrypted with the attacker's master Ed448 key, the payload executes the embedded command via `system()` as root before authentication failure can occur.","enterprise_blast_radius":"Undetectable silent remote root backdoor across all deployed cloud instances, development environments, and container runtimes running compromised distributions."},"references":[{"url":"https://www.openwall.com/lists/oss-security/2024/03/29/4","type":"advisory","title":"Andres Freund Discovery Report"},{"url":"https://www.cisa.gov/news-events/alerts/2024/03/29/backdoor-xz-utils","type":"cisa","title":"CISA Alert: Backdoor in XZ Utils"}],"published_at":"2024-03-29T16:00:00.000Z","updated_at":"2026-10-28T18:00:00.000Z"}}