CVE-2024-3094

high-risk
Published 2024-03-29

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Do I need to act?

!
85.0% chance of exploitation in next 30 days
EPSS score — higher than 15% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
10
CVSS 10.0/10 Critical
NETWORK / LOW complexity

Affected Products (2)

Xz
Xz

Affected Vendors

Tukaani

References (59)

Vendor Advisory https://access.redhat.com/security/cve/CVE-2024-3094
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2272210
Mailing List https://www.openwall.com/lists/oss-security/2024/03/29/4
Vendor Advisory https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
http://www.openwall.com/lists/oss-security/2024/03/29/10
http://www.openwall.com/lists/oss-security/2024/03/29/12
http://www.openwall.com/lists/oss-security/2024/03/29/4
http://www.openwall.com/lists/oss-security/2024/03/29/5
http://www.openwall.com/lists/oss-security/2024/03/29/8
http://www.openwall.com/lists/oss-security/2024/03/30/12
http://www.openwall.com/lists/oss-security/2024/03/30/27
http://www.openwall.com/lists/oss-security/2024/03/30/36
http://www.openwall.com/lists/oss-security/2024/03/30/5
http://www.openwall.com/lists/oss-security/2024/04/16/5
Vendor Advisory https://access.redhat.com/security/cve/CVE-2024-3094
https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-...
Third Party Advisory https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-uti...
Third Party Advisory https://aws.amazon.com/security/security-bulletins/AWS-2024-002/
https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz
Third Party Advisory https://boehs.org/node/everything-i-know-about-the-xz-backdoor
and 39 more references
60
/ 100
high-risk
Severity 33/34 · Critical
Exploitability 20/34 · Moderate
Exposure 7/34 · Low