PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

XZ Utils CVE-2024-3094: A Tale of Broken Trust, Curious Persistence, and a Call to Action

hackerone.com | vulnerability | CVE-2024-3094 | #supply-chain | #open-source | #linux | #backdoor | #xz-utils | #cve-2024-3094
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A backdoor in XZ Utils 5.6.0 and 5.6.1 (CVE-2024-3094) surfaced when Andres Freund noticed sshd slowdowns; the code hid in compressed test files after a long-grooming supply chain effort.
CVE
CVE-2024-3094
Published
Collected

Related coverage

vulnerability · wiz.io
Backdoor in XZ Utils allows RCE: everything you need to know
Wiz explains CVE-2024-3094, the XZ Utils backdoor in versions 5.6.0 and 5.6.1 that could enable SSH authentication bypass and RCE on certain distros; about 2% of cloud environments were affected.
vulnerability · bugcrowd.com
Supply Chain Backdoors, xz/liblzma, CVE-2024-3094, and what we currently know
Summarizes the xz/liblzma CVE-2024-3094 supply chain backdoor: Microsoft's Andres Freund noticed odd SSH CPU usage and 500ms delays, uncovering a backdoor planted by long-term contributor Jia Tan.
blog · kali.org
xz-utils backdoor: how to get started
A beginner walkthrough for reproducing the xz-utils/liblzma backdoor (CVE-2024-3094): set up a Kali VM, install backdoored liblzma 5.6.1 from Debian snapshots, and verify the compromise.
vulnerability · kali.org
All about the xz-utils backdoor
Kali explains CVE-2024-3094: xz-utils 5.6.0-5.6.1 contained a backdoor that could compromise sshd authentication and grant remote system access, with commands to check and patch affected installs.
blog · wiz.io
Crying out Cloud: Our Favorite Stories of 2024
The Crying out Cloud team revisits 2024's top stories—the XZ Utils backdoor (CVE-2024-3094), the SeleniumGreed misconfiguration campaign, and the SAPwned flaws in SAP AI Core—and their lessons.
blog · wiz.io
Defense in depth: XZ Utils
Wiz outlines assessment, prevention and detection steps for the XZ Utils backdoor, using agentless scanning, SBOM search and CDR with the Linux runtime sensor to answer whether you are affected.
Back