CVE-2024-3094General(tukaani / xz)

CVE Vulnerabilities That Shaped the Bug Bounty World A quick timeline worth knowing: 1. CVE-2014-0160 • Heartbleed - 2014 2. CVE-2014-6271 • Shellshock - 2014 3. CVE-2016-5195 • Dirty COW - 2016 4. CVE-2017-0144 • EternalBlue - 2017 5. CVE-2017-5638 • Apache Struts RCE - 2017 6. CVE-2018-7600 • Drupalgeddon2 - 2018 7. CVE-2019-0708 • BlueKeep - 2019 8. CVE-2021-44228 • Log4Shell - 2021 9. CVE-2023-34362 • MOVEit - 2023 10. CVE-2024-3094 • XZ Utils - 2024 Learn the CVE → understand the root cause → study the patch → reproduce safely in a lab. #BugBounty #CVE #CyberSecurity #SecurityResearch #EthicalHacking #InfoSec #AppSec #Pentesting

@ExploitforgeLTD XZ Utils backdoor (CVE-2024-3094)

This was the XZ Utils backdoor (CVE-2024-3094) in Linux's liblzma compression lib. Jia Tan (fake persona, contrib since Oct 2021) inserted it in v5.6.0 (Feb 24 2024) & v5.6.1 (Mar 9 2024). It'd allow remote code exec on SSH via a hidden key. Microsoft engineer Andres Freund spotted it Mar 28 2024 (extra SSH CPU/latency on Debian Sid). Disclosed publicly Mar 29 on oss-security list. Response: Same-day rollback to safe 5.4.x by distros (Debian, Red Hat, etc.); CISA advisory; no exploitation. Caught just before stable rollout.

CVE-2024-3094 scored a perfect 10.0 and the payload was hidden in a test file. 🔐 xz 5.6.0 and 5.6.1 shipped clean-looking source. The BUILD process pulled a prebuilt object out of a test fixture, then patched functions inside liblzma. sshd inherited it. CWE-506, Embedded Malicious Code. Not a mistake, a person earning commit rights over two years. Scored S:C in #CVSS 3.1, the metric 4.0 dropped.

@WordsCocoon @ciaozoomer Microsoft engineer named Andres Freund noticed a tiny 500-millisecond lag during login tests, which led to the discovery of a dangerous hidden backdoor in the data compression tool XZ Utils (tracked as CVE-2024-3094).

Yes — Andres Freund noticed SSH logins on his Debian testing box taking ~500 ms longer with weird CPU spikes. That tiny slowdown uncovered the years-long XZ Utils backdoor (CVE-2024-3094) planted by “Jia Tan.” One meticulous engineer stopped what could have been a silent, widespread remote-root disaster on Linux servers worldwide.

📌 تحذير Red Hat بشأن تضمين برمجيات خبيثة في أداة Linux شائعة تتيح وصولاً غير مصرح به للأنظمة أصدرت Red Hat تحذيراً أمنياً حرجاً بشأن اكتشاف كود خبيث معقد مدمج في الإصدارات الحديثة من أدوات ومكتبات الضغط "xz". يتم تتبع هذا الكود تحت CVE-2024-3094، ويهدف إلى إتاحة وصول غير مصرح به للأنظمة المتأثرة. تُشير هذه العملية إلى تهديد استغلالي خطير يستهدف البنية التحتية التي تعتمد على هذه الأدوات الشائعة. يُنصح بالتحقق الفوري من سلامة تثبيتات "xz" وتحديثها أو الرجوع إلى إصدارات آمنة لدرء مخاطر الاختراق. 🔗 للمزيد: https://cybersecuritynews.com/linux-tool-malware-embedded/

@zuhaitz_dev Is that new or 2024 one? "Critical XZ Utils backdoor (CVE-2024-3094) discovered in March 2024. The vulnerability primarily impacted "rolling" or "testing" distributions (like Debian Testing, Kali, or Fedora Rawhide) that adopted XZ versions 5.6.0 and 5.6.1 very early."

@ciaozoomer This is the XZ Utils backdoor (CVE-2024-3094). One guy (Andres Freund) noticed SSH logins were ~500 ms slower than usual, dug in, and stopped what could have been a supply-chain compromise of a huge chunk of the Linux world. Absolute chad move.

The XZ Utils backdoor (CVE-2024-3094) is a masterclass in supply chain subversion. Our autonomous systems were built to detect this exact type of trust erosion. The new threat surface is the build pipeline.

Más de 500k servidores SSH podrían haberse visto expuestos a una potencial ejecución remota de código (RCE) privilegiado debido a la vulnerabilidad CVE-2024-3094 en xz Utils. Esta vulnerabilidad fue intencionalmente insertada por un atacante en las versiones 5.6.0 y 5.6.1 de la librería de compresión xz. La explotación exitosa podría haber permitido a los atacantes tomar el control de servidores expuestos, poniendo en riesgo infraestructuras críticas. 🧵 (1/6)

Automated multi-VM cyber-range using Ludus deploys GOAD and XZbot labs with Elastic Agent for detection validation against live CVE-2024-3094 backdoor attacks. AI-driven hunting via Elastic SIEM/XDR enhances forensics. #GOADLabs #AIHunting https://ift.tt/f8Gaehv

CVE-2024-3094 refers to a backdoor discovered in March 2024 in XZ Utils, a widely used open-source compression library (versions 5.6.0 and 5.6.1). An attacker, posing as a trusted contributor, inserted malicious code over two years via obfuscated build scripts, potentially allowing remote code execution in SSH servers. This shows that even heavily reviewed open-source projects can harbor undetected backdoors if attackers build long-term trust. While Bitcoin's code is public and audited, no system is immune to such risks—vigilance is key.

@jon3k @greptile For me, security was a side-effect of build hermiticity and developing software for enterprises to run securely (& they're willing to pay a lot for it). The XZ Utils (CVE-2024-3094) was when I started pinning all of my dependencies and adding cooldown periods for updates, etc

The #xz (CVE-2024-3094) is a perfect example of a #supplychainattack. We have a short explainer on the blog on how our Anchore Enterprise customers and OSS #Syft users can immediately report on it. https://anchore.com/blog/we-dont-know-how-to-fix-the-xz-problem-but-we-can-detect-it/ https://t.co/0BkBVG47Rn

GNU IFUNC is the real culprit behind CVE-2024-3094 https://github.com/robertdfrench/ifuncd-up (https://news.ycombinator.com/item?id=48056749)

This MO reminded me of the XZ Utils backdoor (tracked as CVE-2024-3094), a sophisticated supply chain attack targeting Linux systems that was discovered in late March 2024. The Attack Profile The Target: XZ Utils (specifically the liblzma library), a ubiquitous data compression tool used by almost every Linux distribution. The Goal: To compromise SSH (Secure Shell) to allow unauthenticated remote code execution with root privileges. The Actor: An account using the name Jia Tan (JiaT75), widely believed to be a state-sponsored persona or group rather than a single individual. Timeline of the Infiltration Preparation (2021–2022): The persona "Jia Tan" began making small, helpful contributions to various open-source projects to build a credible history. Social Engineering: The original, lone maintainer, Lasse Collin, was struggling with mental health and burnout. Several "puppet" accounts (likely the attacker's stooges) began pressuring Collin to add a new maintainer to help with the workload. Taking Control (2023): Jia Tan successfully became a co-maintainer and eventually took over primary oversight of updates. The Poisoning (Feb–Mar 2024): Jia Tan inserted a multi-stage backdoor into versions 5.6.0 and 5.6.1. The malicious code was hidden inside "test files" and only reassembled during the compilation process to avoid detection by automated scanners. How it was Discovered The backdoor was caught by Andres Freund, a Microsoft engineer, who noticed a 500ms delay in SSH logins on a Debian sid (unstable) system. His investigation into this minor performance anomaly revealed the massive compromise just before it reached stable, mainstream Linux versions. (Similar to Callum McMohan's "out-of-memory" crash discovery) Why it Succeeded Single Points of Failure: Much of the internet's critical infrastructure relies on "zombie" code—venerable projects maintained by a single, often unpaid, volunteer. Patience: The attacker spent nearly three years building trust before striking. Indirect Dependencies: While OpenSSH doesn't use XZ directly, some Linux distributions patch SSH to link with systemd, which in turn uses liblzma, creating the hidden path for the exploit.

@CyberRacheal Great read 👏. I worked on a research project around CVE-2024-3094 with a teammate last year, and revisiting it again is a strong reminder of how critical that incident was for the Linux ecosystem

@cyber_razz Checks CVE... https://access.redhat.com/security/cve/cve-2024-3094 Not affected.

@Acquired_Savant @DavidRedBranch The XZ Utils backdoor (CVE-2024-3094) was discovered in March 2024 and introduced in February 2024 via versions 5.6.0 and 5.6.1. The malicious contributor's efforts began around 2021. It targeted SSH on affected Linux systems but was patched quickly after detection.