XZ Utils backdoor
 | This article documents a current event. Information may change rapidly as the event progresses, and initial news reports may be unreliable. The latest updates to this article may not reflect the most current information. (April 2024) |
| CVE identifier(s) | CVE-2024-3094 |
|---|---|
| Date discovered | March 29, 2024 |
| Discoverer | Andres Freund |
| Affected software | xz / liblzma library |
The XZ utils backdoor is a supply chain attack that maliciously introduced a backdoor in the Linux utility xz within the liblzma library in the version 5.6.0 in February 2024. xz is commonly deployed as part of most Linux distributions.[1] The use of the backdoor is expected to give the attacker remote code execution on the affected Linux systems. It has been assigned a CVE severity score of 10/10.[2]
Background
On 29th of March 2024, PostgreSQL developer Andres Freund reported the backdoor after investigating a performance regression in Debian Sid.[3] Freund noticed that SSH connections were generating unexpectedly high amount of CPU usage as well as causing errors in Valgrind, a memory debugging tool.[4] Freund reported his finding to Openwall Project's open source security mailing list, which brought it to the attention of various software vendors.[4] There is evidence that the attacker made efforts to obfuscate the code[5][6] as the backdoor consists of multiple stages that act together.[7] Once the compromised version is incorporated into the operating system, it alters the behavior of OpenSSH's SSH server daemon by abusing the systemd library, allowing the attacker to gain the same level of access as any authorised administrator.[7][4] According to the analysis by Red Hat, the backdoor can "enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely".[8]
A subsequent investigation found that the backdoor was a culmination of approximately 3 years of effort by a user going by the name Jia Tan and the nickname JiaT75, who appears to have made a concentrated effort to gain access to a position of trust within the xz project, by putting pressure on the head maintainer to step down and hand over the control of the project through the use of sockpuppets.[9][4][10]
Mechanism
The malicious code is known to be in 5.6.0 and 5.6.1 releases of the XZ utils software package. The exploit remains dormant unless a specific third-party patch of the SSH server is used. Under the right circumstances this interference could potentially enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely.[11] The malicious mechanism consists of two compressed test files that contain the malicious binary code. These files are available in the git repository, but remain dormant unless extracted and injected into the program.[12] The code uses the glibc IFUNC mechanism to replace an existing function in OpenSSH called RSA_public_decrypt with a malicious version. OpenSSH normally does not load liblzma, but a common third-party patch used by several Linux distributions causes it to load libsystemd, which in turn loads lzma.[12] A modified version of build-to-host.m4 was included in the release tar file uploaded on GitHub, which extracts a script that performs the actual injection into liblzma. This modified m4 file was not present in the git repository; it was only available from tar files released by the maintainer separate from git.[12] The script appears to only perform the injection when the system is being built on an x86-64 Linux system that uses glibc and GCC and is being built via dpkg or rpm.[12]
Response
The US federal agency responsible for cyber infrastructure, Cybersecurity and Infrastructure Security Agency, has issued a security advisory, recommending that the affected devices should roll back to a previous uncompromised version.[13] Linux software vendors, including Red Hat,[8] SUSE,[14] and Debian,[15] have mirrored the CISA advisory, and reverted the updates for the affected packages to older versions.[citation needed] GitHub has disabled the mirrors for the xz repository.[16]
References
- ^ "NVD - CVE-2024-3094". nvd.nist.gov. Retrieved 2 April 2024.
- ^ Gatlan, Sergiu. "Red Hat warns of backdoor in XZ tools used by most Linux distros". BleepingComputer. Retrieved 29 March 2024.
- ^ Zorz, Zeljka (29 March 2024). "Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094)". Help Net Security. Retrieved 29 March 2024.
- ^ a b c d Goodin, Dan (1 April 2024). "What we know about the xz Utils backdoor that almost infected the world". Ars Technica. Retrieved 1 April 2024.
- ^ Larabel, Michael. "XZ Struck By Malicious Code That Could Allow Unauthorized Remote System Access". www.phoronix.com. Retrieved 29 March 2024.
- ^ O'Donnell-Welch, Lindsey (29 March 2024). "Red Hat, CISA Warn of XZ Utils Backdoor". Decipher. Retrieved 29 March 2024.
- ^ a b Claburn, Thomas. "Malicious backdoor spotted in Linux compression library xz". www.theregister.com. Retrieved 1 April 2024.
- ^ a b "Urgent security alert for Fedora 41 and Fedora Rawhide users". www.redhat.com. Retrieved 29 March 2024.
- ^ Boehs, Evan. "Everything I know about the XZ backdoor". boehs.org. Retrieved 1 April 2024.
- ^ "GitHub has suspended @JiaT75's account. EDIT: Lasse Collin's account @Larhzu has... | Hacker News". news.ycombinator.com. Retrieved 2 April 2024.
- ^ "Urgent security alert for Fedora 41 and Rawhide users". www.redhat.com. Retrieved 29 March 2024.
- ^ a b c d James, Sam. "xz-utils backdoor situation". Gist.
- ^ "Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094 | CISA". www.cisa.gov. 29 March 2024. Retrieved 29 March 2024.
- ^ "SUSE addresses supply chain attack against xz compression library | SUSE Communities". www.suse.com. Retrieved 29 March 2024.
- ^ "[SECURITY] [DSA 5649-1] xz-utils security update". lists.debian.org. Retrieved 29 March 2024.
- ^ Larabel, Michael (29 March 2024). "GitHub Disables The XZ Repository Following Today's Malicious Disclosure". www.phoronix.com. Retrieved 31 March 2024.
