---
id: CVE-2024-3094
title: Malicious backdoor in xz/liblzma (supply-chain compromise)
summary: >-
  A backdoor was intentionally introduced into the xz-utils upstream release
  tarballs (5.6.0 / 5.6.1). When linked into sshd via liblzma, it allows a
  remote attacker holding a specific key to bypass authentication and execute
  commands.
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'
cwe: CWE-506
vendor: liblzma
product: liblzma
platforms:
  - Linux
affected:
  - xz 5.6.0
  - xz 5.6.1
patched:
  - xz 5.6.2
  - xz 5.4.x (unaffected branch)
exploited: false
zeroDay: false
epss: 0.85974
epssPercentile: 0.99719
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-rxwq-x6h5-x52q'
references:
  - url: 'https://www.openwall.com/lists/oss-security/2024/03/29/4'
    label: oss-security disclosure (Andres Freund)
  - url: 'https://github.com/advisories/GHSA-rxwq-x6h5-x52q'
    label: GitHub Advisory
tags:
  - supply-chain
  - backdoor
  - ssh
  - linux
  - exploit-available
ecosystem: xz-utils
exploits:
  github: 84
  githubRepos:
    - 'https://github.com/byinarie/CVE-2024-3094-info'
    - 'https://github.com/FabioBaroni/CVE-2024-3094-checker'
    - 'https://github.com/lypd0/CVE-2024-3094-Vulnerabity-Checker'
  checkedAt: '2026-09-23T07:13:13.800Z'
exploitAvailable: true
---

## Overview

Releases **5.6.0** and **5.6.1** of `xz-utils` shipped source tarballs containing a
deliberately planted backdoor in `liblzma`. The malicious build logic was hidden in
test fixtures and a modified `build-to-host.m4`, activating only inside release
tarballs (not the git tree).

On systems where `sshd` is patched to link `liblzma` (Debian/Fedora-style systemd
notification), the backdoor hooks the RSA key verification path, allowing an attacker
with the correct private key to achieve **pre-auth remote code execution**.

## How it was found

Andres Freund noticed ~500 ms of extra latency on SSH logins and elevated CPU in
`liblzma`, then traced it to the planted payload — caught days after release, before
wide distro adoption.

## Affected versions

Only `5.6.0` and `5.6.1` upstream tarballs. Most stable distros were still on `5.4.x`
and were never exposed. Rolling distros (Fedora 40/41 beta, Debian sid, Kali,
openSUSE Tumbleweed) shipped the bad versions transiently.

```bash
xz --version    # if 5.6.0 or 5.6.1 -> downgrade immediately
```

## Remediation

1. Downgrade `xz`/`liblzma` to `5.4.x` or upgrade to a patched `5.6.2+`.
2. Rotate any SSH host/user keys exposed on a compromised host.
3. Audit package provenance; rebuild from a known-good source where possible.

## References

- oss-security: <https://www.openwall.com/lists/oss-security/2024/03/29/4>
- GitHub Advisory: <https://github.com/advisories/GHSA-rxwq-x6h5-x52q>