Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2024-3094: XZ library can add hidden code to programs
CVE-2024-3094 · published 2 years ago
Summary
The XZ compression library (used in Red Hat Enterprise Linux versions 6 through 10) was found to include hidden malicious code in its source files starting with version 5.6.0. That code can change how any program that uses the library processes data, potentially allowing unauthorized actions. Update to a clean version of the library or apply Red Hat’s recommended patches as soon as possible.
What to do
- Update debian xz-utils to version 5.6.1+really5.4.5-1.
- Update lighttpd to version 1.4.76-r0.
- Update xz to version 5.6.1-r2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | red hat | red hat enterprise linux 10 | All versions |
| – | red hat | red hat enterprise linux 6 | All versions |
| – | red hat | red hat enterprise linux 7 | All versions |
| – | red hat | red hat enterprise linux 8 | All versions |
| – | red hat | red hat enterprise linux 9 | All versions |
| – | red hat | red hat jboss enterprise application platform 8 | All versions |
| Debian:13 | debian | xz-utils |
< 5.6.1+really5.4.5-1 Fix: upgrade to 5.6.1+really5.4.5-1
|
| Alpine:v3.15 | – | lighttpd |
< 1.4.76-r0 Fix: upgrade to 1.4.76-r0
|
| Alpine:v3.20 | – | xz |
< 5.6.1-r2 Fix: upgrade to 5.6.1-r2
|
| – | tukaani | xz |
5.6.0 5.6.1 cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:* |
Original advisory text
Xz: malicious code in distributed source
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3094.j... Vendor Advisory
- http://www.openwall.com/lists/oss-security/2024/03/29/12
- http://www.openwall.com/lists/oss-security/2024/03/29/8
- http://www.openwall.com/lists/oss-security/2024/03/29/10
- https://nvd.nist.gov/vuln/detail/CVE-2024-3094 Vendor Advisory
- https://github.com/tukaani-project/xz Product
- http://www.openwall.com/lists/oss-security/2024/03/30/36
- https://access.redhat.com/downloads/content/package-browser/ URL
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html URL
- https://github.com/advisories/GHSA-rxwq-x6h5-x525 Third Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1222124 Issue Tracking Third Party Advisory
- https://github.com/amlweems/xzbot
- https://github.com/karcherm/xz-malware Third Party Advisory
- https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz
- https://security-tracker.debian.org/tracker/CVE-2024-3094 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-3094 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2272210 Issue Tracking Vendor Advisory
- http://www.openwall.com/lists/oss-security/2024/03/29/4
- http://www.openwall.com/lists/oss-security/2024/03/29/5
- http://www.openwall.com/lists/oss-security/2024/03/30/12
- http://www.openwall.com/lists/oss-security/2024/03/30/27
- http://www.openwall.com/lists/oss-security/2024/03/30/5
- http://www.openwall.com/lists/oss-security/2024/04/16/5
- https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-...
- https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-uti... Third Party Advisory
- https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ Third Party Advisory
- https://boehs.org/node/everything-i-know-about-the-xz-backdoor Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 Mailing List Vendor Advisory
- https://bugs.gentoo.org/928134 Issue Tracking Third Party Advisory
- https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1... Third Party Advisory
- https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 Third Party Advisory
- https://gynvael.coldwind.pl/?lang=en&id=782 Technical Description Third Party Advisory
- https://lists.debian.org/debian-security-announce/2024/msg00057.html Mailing List Third Party Advisory
- https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html Third Party Advisory
- https://lwn.net/Articles/967180/ Issue Tracking Third Party Advisory
- https://news.ycombinator.com/item?id=39865810 Issue Tracking Third Party Advisory
- https://news.ycombinator.com/item?id=39877267 Issue Tracking
- https://news.ycombinator.com/item?id=39895344
- https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/ Third Party Advisory
- https://research.swtch.com/xz-script
- https://research.swtch.com/xz-timeline
- https://security.alpinelinux.org/vuln/CVE-2024-3094 Third Party Advisory
- https://security.archlinux.org/CVE-2024-3094 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240402-0001/
- https://tukaani.org/xz-backdoor/ Issue Tracking Vendor Advisory
- https://twitter.com/LetsDefendIO/status/1774804387417751958 Third Party Advisory
- https://twitter.com/debian/status/1774219194638409898 Press/Media Coverage
- https://twitter.com/infosecb/status/1774595540233167206 Press/Media Coverage
- https://twitter.com/infosecb/status/1774597228864139400 Press/Media Coverage
- https://ubuntu.com/security/CVE-2024-3094 Third Party Advisory
- https://www.binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-d...
- https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-comprom... Third Party Advisory US Government Resource
- https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-back... Third Party Advisory
- https://www.kali.org/blog/about-the-xz-backdoor/
- https://www.openwall.com/lists/oss-security/2024/03/29/4 Mailing List
- https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users Vendor Advisory
- https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-cha... Third Party Advisory
- https://www.theregister.com/2024/03/29/malicious_backdoor_xz/ Press/Media Coverage
- https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094
- https://xeiaso.net/notes/2024/xz-vuln/ Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-506Embedded Malicious Code
Timeline
Published29 Mar 2024
Updated4 Nov 2026
First seen4 Aug 2026
Sources
CVE-2024-3094 · NVD
CVE-2024-3094 · MITRE
GHSA-rxwq-x6h5-x525 · GHSA
CVE-2024-3094 · OSV
DEBIAN-CVE-2024-3094 · OSV
ALPINE-CVE-2024-3094 · OSV
Track software like this
Free during beta