Backdoor Xz Utils Linux Open Source
Infosecurity Magazine covers the XZ Utils open-source backdoor, a malicious implant in liblzma that targeted OpenSSH on major Linux distributions.
The article covers the XZ Utils backdoor, a malicious implant introduced into the widely used open-source compression library. The compromised liblzma code manipulated functions used by OpenSSH, nearly reaching stable releases of major Linux distributions before discovery. The incident is a prominent example of software supply chain compromise targeting critical open-source infrastructure.
- Backdoor code was inserted into the XZ Utils liblzma library used across Linux distributions.
- Implant targeted OpenSSH behavior and nearly shipped in stable releases before being discovered.
- Case highlights supply chain risk in lightly maintained open-source projects.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-3094 | Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library. NVD description · AI analysis pending | 10.0 | 86% |
| — |
The full text could not be extracted from this site (paywall, bot protection or heavy scripting). Read it at infosecurity-magazine.com.