Vulnerability record · CVE-2024-3094 · published 29 March 2024
CVE-2024-3094: XZ Utils liblzma backdoor via malicious build-time code injection
Tukaani · Xz
Malicious code was inserted into upstream xz tarballs starting with version 5.6.0. The liblzma build process extracts a prebuilt object file from a disguised test file and uses it to modify specific functions in liblzma, producing a backdoored library. Any software linked against this library can have its data interactions intercepted and modified, making this a supply-chain compromise of a widely used compression library.
Description
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 10.0 with scope change and high impact across confidentiality, integrity, and availability, combined with a very high EPSS score, makes this a top-priority supply-chain issue despite no KEV listing.
What it is
Malicious code was inserted into upstream xz tarballs starting with version 5.6.0. The liblzma build process extracts a prebuilt object file from a disguised test file and uses it to modify specific functions in liblzma, producing a backdoored library. Any software linked against this library can have its data interactions intercepted and modified, making this a supply-chain compromise of a widely used compression library.
Impact
An attacker gains the ability to intercept and modify data handled by any software linked against the modified liblzma, with the potential to compromise authentication and confidentiality. The CVSS vector indicates high confidentiality, integrity, and availability impact with scope change.
Attack surface
The flaw is reached through the build and distribution chain: malicious code is present in upstream tarballs and is activated when liblzma is built and linked into dependent software. The CVSS vector is network-reachable with no privileges or user interaction required, but exploitation depends on a vulnerable build being deployed and a linked service being reachable.
Exploitation
CISA KEV does not list this CVE, but EPSS is very high at 0.85974 (99.7th percentile), and references include vendor advisories and third-party analyses describing the backdoor. The record does not state that exploitation has been observed in the wild.
What to do
- Identify and remove or downgrade any xz/liblzma build at version 5.6.0 or 5.6.1, and rebuild affected software from trusted sources.
- Apply vendor advisories from Red Hat, Debian, SUSE, Gentoo, NixOS, AWS and others for patched or reverted packages.
- Verify package and tarball integrity against upstream signatures and known-good hashes before building or deploying.
- Audit build pipelines and CI systems for unauthorized modifications to source tarballs or build scripts.
- Monitor linked services that depend on liblzma, especially remote access components, for unexpected behavior after remediation.
Detection
- Search hosts and build artifacts for xz/liblzma versions 5.6.0 and 5.6.1.
- Inspect build logs and source trees for the disguised test files and extracted object files described in the advisory.
- Monitor for unexpected outbound connections or data modification in services linked against liblzma.
- Compare installed library hashes against vendor-published known-good values.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2024-3094 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-3094), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
