xz-utils backdoor (CVE-2024-3094)

Updates on May 29, 2024

Summary

A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.

Advisories4

• Reported supply chain compromise affecting XZ Utils, CVE-2024-3094CISA · Mar 29, 2024
• Urgent security alert for Fedora 41 and Rawhide usersRed Hat · Mar 29, 2024
• XZ Utils backdoorLasse Collin (tukaani.org)
• NVD: CVE-2024-3094NVD · Mar 29, 2024