# [CVE-2024-3094] XZ Utils / liblzma Malicious Code Supply Chain Backdoor
**Severity:** CRITICAL | **CVSS Base Score:** 10 (3.1)
**CVSS Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`
**EPSS Exploit Probability:** 98.50% (Percentile: 99.70%)
**CISA KEV (In The Wild):** YES (Due: Mon Apr 22 2024 00:00:00 GMT+0000 (Coordinated Universal Time))
**Known Ransomware Campaigns:** None documented
**Exploit Status:** weaponized
**Published:** 2024-03-29 | **Updated:** 2026-10-28

## Executive Summary
Sophisticated malicious backdoor inserted into upstream tarballs of XZ Utils (liblzma) compromising SSH authentication on Linux systems.

## Common Weakness Enumeration (CWE)
- **CWE-506**: Embedded Malicious Code
- **CWE-829**: Inclusion of Functionality from Untrusted Control Sphere

## Affected Vendors & Products
- **Vendor:** Tukaani | **Product:** XZ Utils / liblzma
  - **Affected Versions:** 5.6.0, 5.6.1
  - **Patched Version:** 5.6.2 (or downgrade to 5.4.6)

## Technical Root Cause Analysis (AI Defense Agent)
The attacker orchestrated a multi-year social engineering campaign to gain co-maintainer status on XZ Utils. Obfuscated shell scripts inside `tests/` archives extracted an ELF object file during build time, which modified `liblzma.so` symbols via GNU indirect functions (IFUNC), hooking OpenSSH's RSA verification routines.

## Exploitation Mechanism & Attack Scenario
When a target sshd service initializes, the malicious liblzma hooks `RSA_public_decrypt`. When an SSH client attempts authentication presenting a signature encrypted with the attacker's master Ed448 key, the payload executes the embedded command via `system()` as root before authentication failure can occur.

## Enterprise Blast Radius
Undetectable silent remote root backdoor across all deployed cloud instances, development environments, and container runtimes running compromised distributions.

## Remediation & Mitigation Playbook
1. Downgrade xz-utils and liblzma to 5.4.x (e.g. 5.4.6) across all systems.
2. Audit software build pipelines and artifact checksums against verified trusted upstream git commits.
3. Implement binary integrity checks and enforce strict supply chain provenance verification (SLSA Level 3+).

## Detection Guidance & Telemetry
Run `xz --version` and check for 5.6.0 or 5.6.1. Inspect glibc dynamic symbol tables with `readelf` on `liblzma.so` to detect anomalous IFUNC references.

### Sigma Detection Rule
```yaml
title: Detection of Vulnerable XZ Utils 5.6.x
status: critical
logsource:
  product: linux
detection:
  selection:
    package_version|startswith:
      - '5.6.0'
      - '5.6.1'
  condition: selection
```


## References
- [Andres Freund Discovery Report](https://www.openwall.com/lists/oss-security/2024/03/29/4) (advisory)
- [CISA Alert: Backdoor in XZ Utils](https://www.cisa.gov/news-events/alerts/2024/03/29/backdoor-xz-utils) (cisa)