CVE-2024-3094 (CVSS 10): Backdoor Flaw Discovered in Popular Linux Compression Tool
A severe backdoor vulnerability (designated CVE-2024-3094) has been unearthed in versions 5.6.0 and 5.6.1 of the widely used XZ Utils compression library. This vulnerability could allow attackers to bypass SSH authentication on certain Linux distributions, potentially granting them full remote access to compromised systems.
What Happened?
- Malicious code was deliberately inserted into the source code of XZ Utils. This code is cleverly disguised and cannot be found within the regular code repository (Git).
- During the build process, the malicious code injects a pre-compiled file that modifies core components of the liblzma library, which XZ Utils depends on.
- Some Linux distributions integrate a compromised liblzma library into their SSH implementations, leaving them vulnerable to remote attackers.
The Severity
Rated at the highest severity level with a Common Vulnerability Scoring System (CVSS) score of 10, this vulnerability has the potential to compromise the integrity of affected systems, enabling unauthorized SSH authentication bypass under certain conditions. Due to the critical nature of SSH in securing remote access to Linux systems, the potential impact of the CVE-2024-3094 vulnerability is considerable. If successfully exploited, threat actors could gain unrestricted access to vulnerable machines, leading to data breaches, system disruptions, and further malware deployment.
Who’s at Risk?
Linux distributions confirmed as potentially affected include:
- Pre-release versions of Fedora Linux 40 and 41 (Rawhide)
- Testing, unstable, and experimental branches of Debian
- Kali Linux (versions distributed between March 26 – 29)
- Potentially other distributions (investigations ongoing)
How the Backdoor was Hidden
The vulnerability’s creator took sophisticated measures to conceal their malicious activity:
- Source Code Disguise: The backdoor code exists only in the full XZ source package download, not in the standard Git repository.
- Obfuscation: Complex obfuscation techniques were used to hide the code’s true intent.
- Fuzzer Evasion: Evidence suggests attempts to deliberately sabotage the ‘oss-fuzz’ code testing project, which may have otherwise caught the backdoor.
What You Should Do
Security teams are urged to take immediate action:
- Check Your XZ Utils Version: The Cybersecurity and Infrastructure Security Agency (CISA) has issued recommendations for mitigating this threat, advising affected users to downgrade to an uncompromised version of XZ Utils (earlier than 5.6.0)
- Upgrade Systems: Follow specific security advisories published by affected Linux distributions.
- Monitor for Compromise: Review system logs and network activity for signs of unauthorized access or unusual behavior.
Ongoing Investigations
Security researchers and vendors are actively working to identify the full extent of this vulnerability and the range of distributions affected. Stay vigilant and update your systems as more information and security patches become available.
