by Kastro
Paper/Archive/CVE-2024-3094

CVE-2024-3094

Red Hat Red Hat Enterprise Linux 10 — Xz: malicious code in distributed source

EPSS 91%CVSS 10.0
critical.is priorityof 100
50
CVSS 10.0 (CNA, NVD agree)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 99.8.998 × 2020.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Affected

ProductAffectedFixed inSource
xz5.6.0–CNA
xz5.6.1–CNA
Red Hat Enterprise Linux 10see advisory–CNA
Red Hat Enterprise Linux 6see advisory–CNA
Red Hat Enterprise Linux 7see advisory–CNA
Red Hat Enterprise Linux 8see advisory–CNA
Red Hat Enterprise Linux 9see advisory–CNA
Red Hat JBoss Enterprise Application Platform 8see advisory–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
redhat (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refaccess.redhat.com/security/cve/CVE-2024-3094refbugzilla.redhat.com/show_bug.cgi?id=2272210refopenwall.com/lists/oss-security/2024/03/29/4refredhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-usersrefbinarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-imagesrefariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problemrefarstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connectionsrefaws.amazon.com/security/security-bulletins/AWS-2024-002refblog.netbsd.org/tnf/entry/statement_on_backdoor_in_xzrefboehs.org/node/everything-i-know-about-the-xz-backdoorrefbugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024refbugs.gentoo.org/928134refbugzilla.suse.com/show_bug.cgi?id=1222124refdiscourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405refgist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27refgithub.com/advisories/GHSA-rxwq-x6h5-x525refgithub.com/amlweems/xzbotrefgithub.com/karcherm/xz-malwarerefgynvael.coldwind.pl/?lang=en&id=782reflists.debian.org/debian-security-announce/2024/msg00057.htmlreflists.freebsd.org/archives/freebsd-security/2024-March/000248.htmlreflwn.net/Articles/967180refnews.ycombinator.com/item?id=39865810refnews.ycombinator.com/item?id=39877267refnews.ycombinator.com/item?id=39895344refopenssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094refresearch.swtch.com/xz-scriptrefresearch.swtch.com/xz-timelinerefsecurity-tracker.debian.org/tracker/CVE-2024-3094refsecurity.alpinelinux.org/vuln/CVE-2024-3094refsecurity.archlinux.org/CVE-2024-3094refsecurity.netapp.com/advisory/ntap-20240402-0001reftukaani.org/xz-backdoorreftwitter.com/LetsDefendIO/status/1774804387417751958reftwitter.com/debian/status/1774219194638409898reftwitter.com/infosecb/status/1774595540233167206reftwitter.com/infosecb/status/1774597228864139400refubuntu.com/security/CVE-2024-3094refcisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094refdarkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utilsrefkali.org/blog/about-the-xz-backdoorreftenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utilsreftheregister.com/2024/03/29/malicious_backdoor_xzrefvicarius.io/vsociety/vulnerabilities/cve-2024-3094refxeiaso.net/notes/2024/xz-vulnrefopenwall.com/lists/oss-security/2024/03/30/12refopenwall.com/lists/oss-security/2024/03/30/27refopenwall.com/lists/oss-security/2024/03/29/12refopenwall.com/lists/oss-security/2024/03/29/10refopenwall.com/lists/oss-security/2024/03/30/36refopenwall.com/lists/oss-security/2024/04/16/5refopenwall.com/lists/oss-security/2024/03/29/8refopenwall.com/lists/oss-security/2024/03/30/5refopenwall.com/lists/oss-security/2024/03/29/5refopenwall.com/lists/oss-security/2024/03/29/4