CVE-2024-3094

Description

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Scoring

Affected (1)

References

• https://access.redhat.com/security/cve/CVE-2024-3094
• https://bugzilla.redhat.com/show_bug.cgi?id=2272210
• https://www.openwall.com/lists/oss-security/2024/03/29/4
• https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
• http://www.openwall.com/lists/oss-security/2024/03/29/10
• http://www.openwall.com/lists/oss-security/2024/03/29/12
• http://www.openwall.com/lists/oss-security/2024/03/29/4
• http://www.openwall.com/lists/oss-security/2024/03/29/5
• http://www.openwall.com/lists/oss-security/2024/03/29/8
• http://www.openwall.com/lists/oss-security/2024/03/30/12
• http://www.openwall.com/lists/oss-security/2024/03/30/27
• http://www.openwall.com/lists/oss-security/2024/03/30/36
• http://www.openwall.com/lists/oss-security/2024/03/30/5
• http://www.openwall.com/lists/oss-security/2024/04/16/5
• https://access.redhat.com/security/cve/CVE-2024-3094
• https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/
• https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/
• https://aws.amazon.com/security/security-bulletins/AWS-2024-002/
• https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz
• https://boehs.org/node/everything-i-know-about-the-xz-backdoor