CVE 2024 3094: The xz utils 5.6.0 Backdoor Incident

On 29 March 2024, the open-source lossless compression tool xz-utils (and the linked liblzma library) was discovered to contain carefully planted malicious code, with the ID CVE-2024-3094. xz-utils is widely used to compress distribution tarballs, software packages, kernel images, and initramfs images, and is installed by default on almost every Linux and macOS system.

How the Vulnerability Works

In the upstream tarballs of xz 5.6.0 and 5.6.1, the malicious code is hidden inside source files disguised as “test files” through a series of obfuscation steps:

1. During the build, the prebuilt object files are extracted from the disguised test files in the source.
2. Those object files are then used to modify specific functions in the liblzma library.
3. The final result is a tampered liblzma library. Any software linked to it (such as sshd) is intercepted and manipulated at runtime.

The implant was the result of long-term social engineering targeting the upstream maintainers, and it spanned multiple version numbers.

Scope

Field	Value
Affected versions	xz-utils 5.6.0, 5.6.1
Affected component	liblzma (when linked by sshd etc.)
Affected systems	Rolling-release distributions (some unstable / pre-release versions)
Severity	High (potential remote unauthorized access)
Prerequisite	Target host runs a tainted xz-utils 5.6.0/5.6.1

Impact on Shudou

• The Debian 12 that ships on Shudou hosts includes xz-utils version 5.4.1-0.2, which is outside the affected 5.6.0 / 5.6.1 range.
• According to Debian’s official security tracker, the malicious code described in this incident has not been found in this version.
• Shudou will continue to monitor the situation and apply any new official fixes as soon as they become available.

References

• Debian Security Tracker — CVE-2024-3094
• NVD — CVE-2024-3094
• Red Hat — CVE-2024-3094
• thesamesam technical analysis (Gist)