CVE-2024-3094
CRITICAL · 10.0 EPSS 86.0%Real vuln, patched; chatter is stale debate, not active exploitation or new findings.
What: Malicious code injected into xz/liblzma (versions 5.6.0+) via obfuscated build process, enabling data interception in any linked software. CVSS 10.0 CRITICAL, EPSS 0.85.
Why it matters: This is the infamous xz backdoor discovered March 2024—a supply-chain attack that nearly reached production OpenSSH. No KEV listing yet, but the vuln is real, widely analyzed, and patches exist. Social chatter is dominated by post-hoc technical debate (GNU IFUNC blame-shifting) rather than active exploitation signals or new PoCs.
Where it's seen: Hacker News discussion threads recycling analysis; blame-shifting toward GNU IFUNC as "root cause" rather than focusing on xz malware itself; no fresh PoC or in-the-wild exploitation claims in this batch.
RISK: CRITICAL — Supply-chain backdoor in critical compression library; nearly compromised OpenSSH.
Description
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected versions
- tukaani/xz
- 5.6.0
- 5.6.1
References
- https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/
- https://aws.amazon.com/security/security-bulletins/AWS-2024-002/
- https://boehs.org/node/everything-i-know-about-the-xz-backdoor
- https://bugs.gentoo.org/928134
- https://bugzilla.suse.com/show_bug.cgi?id=1222124
- https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405
- https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27
- https://github.com/advisories/GHSA-rxwq-x6h5-x525
- +16 more
- https://www.openwall.com/lists/oss-security/2024/03/29/4 [Mailing List]
- http://www.openwall.com/lists/oss-security/2024/03/29/10
- http://www.openwall.com/lists/oss-security/2024/03/29/12
- http://www.openwall.com/lists/oss-security/2024/03/29/4
- http://www.openwall.com/lists/oss-security/2024/03/29/5
- http://www.openwall.com/lists/oss-security/2024/03/29/8
- http://www.openwall.com/lists/oss-security/2024/03/30/12
- http://www.openwall.com/lists/oss-security/2024/03/30/27
- +15 more