# xz-utils backdoor (CVE-2024-3094) · pwn.watch

> A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.

Page: https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094 · generated 2026-10-22T20:45:43.249Z

## Status
- Severity: critical · status: closed · patch: patched
- Product: XZ Utils (liblzma)
- Started: 2024-03-29 · closed: 2024-05-29
- CVEs: CVE-2024-3094
- Affected: 5.6.0; 5.6.1
- Fixed in: Downgrade to an uncompromised version such as 5.4.6 Stable (CISA); 5.6.2 clean release (2024-05-29, tukaani.org)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094/feed.xml
- JSON Feed: https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094.json
- This file: https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094/llms.txt

## Updates (newest first)
- 2024-05-29: Lasse Collin publishes review notes 1.0 and new clean XZ Utils releases (https://tukaani.org/xz-backdoor/)
- 2024-04-09: XZ Git repositories available on GitHub again (https://tukaani.org/xz-backdoor/)
- 2024-03-30: xz@tukaani.org stops forwarding to Jia Tan (https://tukaani.org/xz-backdoor/)
- 2024-03-29: Andres Freund discloses the backdoor on oss-security (https://www.openwall.com/lists/oss-security/2024/03/29/4)
- 2024-03-29: CISA alert: downgrade XZ Utils to an uncompromised version such as 5.4.6 (https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094)
- 2024-03-29: Red Hat urgent security alert for Fedora 41 and Rawhide users (https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users)

## Fix brief
# Security brief: xz-utils backdoor (CVE-2024-3094)

Source: https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094 · status: closed (closed May 29, 2024) · severity: critical · updated May 29, 2024

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.

Severity detail: Red Hat rating Critical; supply-chain backdoor

- Product: XZ Utils (liblzma)
- CVE / advisory ids: CVE-2024-3094

## Affected versions
- 5.6.0
- 5.6.1

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Downgrade to an uncompromised version such as 5.4.6 Stable (CISA)
- 5.6.2 clean release (2024-05-29, tukaani.org)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- May 29, 2024: Lasse Collin publishes review notes 1.0 and new clean XZ Utils releases
- Apr 9, 2024: XZ Git repositories available on GitHub again
- Mar 30, 2024: xz@tukaani.org stops forwarding to Jia Tan
- Mar 29, 2024: Andres Freund discloses the backdoor on oss-security
- Mar 29, 2024: CISA alert: downgrade XZ Utils to an uncompromised version such as 5.4.6
- Mar 29, 2024: Red Hat urgent security alert for Fedora 41 and Rawhide users

## Advisories
- [Reported supply chain compromise affecting XZ Utils, CVE-2024-3094](https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094) (CISA)
- [Urgent security alert for Fedora 41 and Rawhide users](https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users) (Red Hat)
- [XZ Utils backdoor](https://tukaani.org/xz-backdoor/) (Lasse Collin (tukaani.org))
- [NVD: CVE-2024-3094](https://nvd.nist.gov/vuln/detail/CVE-2024-3094) (NVD)

## Write-ups & news
- [backdoor in upstream xz/liblzma leading to ssh server compromise](https://www.openwall.com/lists/oss-security/2024/03/29/4)

---
Machine-readable: https://pwn.watch/i/xz-utils-backdoor-cve-2024-3094.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.