On March 29th, 2024, a backdoor (CVE-2024-3094) was discovered in xz-utils by Andres Freund while debugging some performance issue on an sshd daemin. The xz-utils package is commonly used for compressing release tarballs, software packages, kernel images, initramfs images and many others. The xz-utils include the liblzma library used by various software including sshd which is one of the known technique to abuse the backdoor.
Detection
We recommend reviewing the dynamic linking of the sshd daemon (as it’s one of the known ways to use the backdoor) to ensure there is no link to liblzma. You can do this by using the command ldd "$(command -v sshd)".
liblzma is distributed by xz-utils. If there is a link to liblzma, then check the version of xz-utils that is installed.
The vulnerable backdoored versions are 5.6.0 and 5.6.1. If you have these versions installed, please review the logs of your system and initiate an incident response procedure for it.”
Known affected distribution
- Archlinux - The xz packages prior to version 5.6.1-2 (specifically 5.6.0-1 and 5.6.1-1) contain this backdoor.
- Debian testing, unstable and experimental distributions versions 5.5.1alpha-0.1 to 5.6.1-1.
- Fedora Rawhide - development distribution.
- Fedora 41 and maybe Fedora 40 (depending of the timing of system update) - production distribution.
- Kali - The impact of this vulnerability affected Kali between March 26th to March 29th.
- openSUSE Tumbleweed and openSUSE MicroOS - Our rolling release distribution openSUSE Tumbleweed and openSUSE MicroOS included this version between March 7th and March 28th.
References
- oss-security: Original report from Andres Freund - backdoor in upstream xz/liblzma leading to ssh server compromise
- Gist: Compilation of different sources about the xz-utils backdoor - FAQ on the xz-utils backdoor
- Tenable: Frequently Asked Questions About CVE-2024-3094, A Backdoor in XZ Utils
Classification of this document
TLP:CLEAR information may be distributed without restriction, subject to copyright controls.
Revision
- Version 1.0 - TLP:CLEAR - First version - 30th March 2024