erroneo.us
Search all guides⌘K

Security Digest · Vulnerability record

CVE-2024-3094: Xz: malicious code in distributed source

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.

CVSS 10.0 Critical EPSS 90.9% · p99.8 Check exposure

Updated By erroneo.us Security Desk57 references

Should you act?

High exploit likelihood

EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

  • No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
  • EPSS 90.9%, percentile 99.8: FIRST’s model estimates a 90.9% chance of exploitation activity in the next 30 days, higher than 99.8% of all scored CVEs (very high). EPSS is a probability, not a verdict.
  • Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
  • Editorial verdict: Check exposure. xz-utils Backdoor in liblzma 5.6.0/5.6.1 (CVE-2024-3094) — The backdoor only reached rolling and pre-release distributions for a few weeks before discovery; stable enterprise releases never shipped it, but any machine that ran xz 5.6.0 or 5.6.1 should be checked.

What it is

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Weakness type: CWE-506.

Product: xz · Assigned by: redhat · Published: 2024-03-29

Affected and fixed versions

VendorProductAffected versions (per CVE record)
xz5.6.0, 5.6.1
Red HatRed Hat Enterprise Linux 10see vendor advisory
Red HatRed Hat Enterprise Linux 6see vendor advisory
Red HatRed Hat Enterprise Linux 7see vendor advisory
Red HatRed Hat Enterprise Linux 8see vendor advisory
Red HatRed Hat Enterprise Linux 9see vendor advisory
Red HatRed Hat JBoss Enterprise Application Platform 8see vendor advisory

Severity scores

Scored byCVSSScoreVector
redhat3.110 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  • Attack vector: network (remotely reachable)
  • Attack complexity: low
  • Privileges required: none (no login)
  • User interaction: none
  • Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

  • CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
  • CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
  • FIRST EPSS (model of 2026-10-21): 90.90% probability of exploitation activity in the next 30 days; percentile 99.8.

Timeline

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

  1. CVE.org record CVE-2024-3094 cve.org
  2. NVD entry CVE-2024-3094 nvd.nist.gov

Other references from the CVE record and advisory

  1. access.redhat.com access.redhat.com
  2. RHBZ#2272210 bugzilla.redhat.com
  3. openwall.com openwall.com
  4. redhat.com redhat.com
  5. binarly.io binarly.io
  6. ariadne.space ariadne.space
  7. arstechnica.com arstechnica.com
  8. aws.amazon.com aws.amazon.com
  9. blog.netbsd.org blog.netbsd.org
  10. boehs.org boehs.org
  11. bugs.debian.org bugs.debian.org
  12. bugs.gentoo.org bugs.gentoo.org
  13. bugzilla.suse.com bugzilla.suse.com
  14. discourse.nixos.org discourse.nixos.org
  15. gist.github.com gist.github.com
  16. github.com github.com
  17. github.com github.com
  18. github.com github.com
  19. gynvael.coldwind.pl gynvael.coldwind.pl
  20. lists.debian.org lists.debian.org
  21. lists.freebsd.org lists.freebsd.org
  22. lwn.net lwn.net
  23. news.ycombinator.com news.ycombinator.com
  24. news.ycombinator.com news.ycombinator.com
  25. news.ycombinator.com news.ycombinator.com
  26. openssf.org openssf.org
  27. research.swtch.com research.swtch.com
  28. research.swtch.com research.swtch.com
  29. security-tracker.debian.org security-tracker.debian.org
  30. security.alpinelinux.org security.alpinelinux.org
  31. security.archlinux.org security.archlinux.org
  32. security.netapp.com security.netapp.com
  33. tukaani.org tukaani.org
  34. twitter.com twitter.com
  35. twitter.com twitter.com
  36. twitter.com twitter.com
  37. twitter.com twitter.com
  38. ubuntu.com ubuntu.com
  39. cisa.gov cisa.gov
  40. darkreading.com darkreading.com
  41. kali.org kali.org
  42. tenable.com tenable.com
  43. theregister.com theregister.com
  44. vicarius.io vicarius.io
  45. xeiaso.net xeiaso.net
  46. openwall.com openwall.com
  47. openwall.com openwall.com
  48. openwall.com openwall.com
  49. openwall.com openwall.com
  50. openwall.com openwall.com
  51. openwall.com openwall.com
  52. openwall.com openwall.com
  53. openwall.com openwall.com
  54. openwall.com openwall.com
  55. openwall.com openwall.com

Today’s Security Digest