A backdoor was hidden in a compression library used by Linux SSH servers. It was found by chance before reaching most stable systems. What it teaches about trust in software.
Publicly disclosed: 29 March 2024
On 29 March 2024 a developer noticed that SSH logins on a test system were slightly slower than usual. Investigating, he discovered that versions 5.6.0 and 5.6.1 of XZ Utils — a compression library present on almost every Linux system — contained a carefully hidden backdoor. A contributor had spent years gaining the trust of the project before inserting it.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2024-3094 | Critical, CVSS 10.0 (malicious code) | xz / liblzma 5.6.0 and 5.6.1 | Downgrade to 5.4.x or update to 5.6.2 and later |
Through the way some distributions link the SSH server with system libraries, the backdoor could have allowed the attacker to run commands on servers via SSH. It reached mainly test and rolling releases (such as Debian testing, Fedora 40 beta, Arch); most stable server releases were not affected because it was found early.
xz --version. Versions 5.6.0 and 5.6.1 must be replaced.Every piece of software is built on trust. Verify where you can, and limit what can reach your servers.
Sources: Openwall oss-security, CISA alert, NVD CVE-2024-3094.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.