{"id":"CVE-2024-3094","title":"Malicious backdoor in xz/liblzma (supply-chain compromise)","summary":"A backdoor was intentionally introduced into the xz-utils upstream release tarballs (5.6.0 / 5.6.1). When linked into sshd via liblzma, it allows a remote attacker holding a specific key to bypass authentication and execute commands.","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":"CWE-506","vendor":"liblzma","product":"liblzma","platforms":["Linux"],"affected":["xz 5.6.0","xz 5.6.1"],"patched":["xz 5.6.2","xz 5.4.x (unaffected branch)"],"exploited":false,"zeroDay":false,"epss":0.85974,"epssPercentile":0.99725,"source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-rxwq-x6h5-x52q","references":[{"url":"https://www.openwall.com/lists/oss-security/2024/03/29/4","label":"oss-security disclosure (Andres Freund)"},{"url":"https://github.com/advisories/GHSA-rxwq-x6h5-x52q","label":"GitHub Advisory"}],"tags":["supply-chain","backdoor","ssh","linux","exploit-available"],"ecosystem":"xz-utils","exploits":{"github":84,"githubRepos":["https://github.com/byinarie/CVE-2024-3094-info","https://github.com/FabioBaroni/CVE-2024-3094-checker","https://github.com/lypd0/CVE-2024-3094-Vulnerabity-Checker"],"checkedAt":"2026-09-21T15:23:22.336Z"},"exploitAvailable":true,"slug":"CVE-2024-3094","body":"## Overview\n\nReleases **5.6.0** and **5.6.1** of `xz-utils` shipped source tarballs containing a\ndeliberately planted backdoor in `liblzma`. The malicious build logic was hidden in\ntest fixtures and a modified `build-to-host.m4`, activating only inside release\ntarballs (not the git tree).\n\nOn systems where `sshd` is patched to link `liblzma` (Debian/Fedora-style systemd\nnotification), the backdoor hooks the RSA key verification path, allowing an attacker\nwith the correct private key to achieve **pre-auth remote code execution**.\n\n## How it was found\n\nAndres Freund noticed ~500 ms of extra latency on SSH logins and elevated CPU in\n`liblzma`, then traced it to the planted payload — caught days after release, before\nwide distro adoption.\n\n## Affected versions\n\nOnly `5.6.0` and `5.6.1` upstream tarballs. Most stable distros were still on `5.4.x`\nand were never exposed. Rolling distros (Fedora 40/41 beta, Debian sid, Kali,\nopenSUSE Tumbleweed) shipped the bad versions transiently.\n\n```bash\nxz --version    # if 5.6.0 or 5.6.1 -> downgrade immediately\n```\n\n## Remediation\n\n1. Downgrade `xz`/`liblzma` to `5.4.x` or upgrade to a patched `5.6.2+`.\n2. Rotate any SSH host/user keys exposed on a compromised host.\n3. Audit package provenance; rebuild from a known-good source where possible.\n\n## References\n\n- oss-security: <https://www.openwall.com/lists/oss-security/2024/03/29/4>\n- GitHub Advisory: <https://github.com/advisories/GHSA-rxwq-x6h5-x52q>","depth":"abyssal","depthScore":84,"depthScoreParts":{"impact":55,"likelihood":17.2,"exploitation":12,"ransomware":0},"changes":[{"seq":4434,"id":"CVE-2024-3094","ts":1788887179048,"field":"exploit_available","old":"false","new":"true"},{"seq":3317,"id":"CVE-2024-3094","ts":1788886298126,"field":"exploit_available","old":"true","new":"false"},{"seq":2172,"id":"CVE-2024-3094","ts":1788882968074,"field":"exploit_available","old":"false","new":"true"},{"seq":1201,"id":"CVE-2024-3094","ts":1788882367294,"field":"exploit_available","old":"true","new":"false"},{"seq":315,"id":"CVE-2024-3094","ts":1788881814203,"field":"exploit_available","old":"false","new":"true"}]}