Frequently asked questions about CVE-2024-3094, a supply-chain attack responsible for a backdoor in XZ Utils, a widely used library found in multiple Linux distributions.

Frequently Asked Questions About CVE-2024-3094, A Backdoor in XZ Utils

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Additional Linux distributions affected by the supply-chain backdoor of XZ Utils have been identified. Update to a fixed version as soon as possible.

Reported supply chain compromise involving XZ Utils command line tool. Situation is developing. Developers/users are advised to downgrade to stable version and investigate.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a
    series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised
    test file existing in the source code, which is then used to modify specific functions in the liblzma
    code. This results in a modified liblzma library that can be used by any software linked against this
    library, intercepting and modifying the data interaction with this library. (CVE-2024-3094)

The version of XZ Utils installed on the remote host is potentially affected by a backdoor vulnerability.

Note: This plugin is paranoid because not all instances of the affected versions of XZ Utils are known to be vulnerable to the backdoor. The method of installation of XZ Utils plays a role in whether the install is vulnerable or not. However, multiple vendors have rolled out remediation fixes as a precaution.

Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

As this detection can lead to potential false positives, it is recommended that manual verification of identified instances be performed.

For more information, refer to https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils

The remote host is affected by the vulnerability described in GLSA-202403-04 (XZ utils: Backdoor in release tarballs)

  - Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a     series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised     test file existing in the source code, which is then used to modify specific functions in the liblzma     code. This results in a modified liblzma library that can be used by any software linked against this     library, intercepting and modifying the data interaction with this library. (CVE-2024-3094)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The XZ Utils installed on the remote host is affected by a backdoor ssh vulnerability.

ID	Name	Product	Family	Severity
425706	Alpine: multiple lighttpd packages: security update to 1.4.76-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
425706	Alpine: multiple lighttpd packages: security update to 1.4.76-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
424739	Alpine: multiple xz packages: security update to 5.6.1-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
424739	Alpine: multiple xz packages: security update to 5.6.1-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
192737	XZ Utils 5.6.0 / 5.6.1 Liblzma Backdoor Check	Nessus	Misc.	critical
192734	GLSA-202403-04 : XZ utils: Backdoor in release tarballs	Nessus	Gentoo Local Security Checks	critical
192708	Potential exposure to XZ Utils SSH Backdoor (CVE-2024-3094)	Nessus	Misc.	critical

Detections

Analytics

CVE-2024-3094

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical