XZ Utils: backdoor in 5.6.0/5.6.1 release tarballs targets sshd via liblzma (CVE-2024-3094)
Severity: critical · Patch status: patched · Since 2024-03-29 · CVE-2024-3094
The upstream xz 5.6.0 (2024-02-24) and 5.6.1 (2024-03-09) release tarballs, created and signed by the maintainer account 'Jia Tan', contained an extra line in m4/build-to-host.m4 that is absent from the git source. During the build it unpacked a payload hidden in test files and, on x86-64 Linux builds with gcc and the GNU linker for Debian or RPM packages, injected code into liblzma. When sshd is linked to liblzma through libsystemd (as in distributions that patch OpenSSH for systemd notification) the code replaced crc ifunc resolvers and hooked RSApublicdecrypt, so a holder of the matching key could run code before authentication. Andres Freund found it on Debian sid after noticing slow, CPU-heavy SSH logins and valgrind errors, and disclosed it on oss-security on 2024-03-29. Red Hat says no RHEL version was affected; Fedora Rawhide (5.6.0/5.6.1), the Fedora 40 beta (5.6.0, not shown to be exploitable) and Debian unstable were. The fix was to downgrade to 5.4.6 or earlier (CISA) and later upstream released clean builds including 5.6.2 on 2024-05-29.
What to do
- Find hosts running xz/liblzma 5.6.0 or 5.6.1 (xz --version; package manager query) and downgrade to 5.4.x or install the distribution's patched package.
- Stop using Fedora Rawhide and any Fedora 40 beta image built with xz 5.6.x until reverted, per Red Hat guidance.
- Check Debian unstable/testing and other rolling or pre-release systems that tracked upstream 5.6.x for the affected package, and treat sshd hosts that ran it as potentially exposed.
- Report positive findings to CISA if you are a US entity, as its alert asks.
Fixed versions
- xz 5.4.6 (downgrade, CISA)
- xz 5.6.2 (2024-05-29, backdoor removed)
Sources
All live incidents on Threat Watch
