Binarly released a free online scanner to detect the CVE-2024
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-3094 | Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library. NVD description · AI analysis pending | 10.0 | 86% |
| — |
Full article379 words · extracted from securityaffairs.com · click to collapse
Researchers from the firmware security firm Binarly released a free online scanner to detect the CVE-2024-3094 Backdoor
Last week, Microsoft engineer Andres Freund discovered a backdoor issue in the latest versions of the “xz” tools and libraries. The vulnerability was tracked as CVE-2024-3094 and received a CVSS score of 10.
Red Hat urges users to immediately stop using systems running Fedora development and experimental versions because of a backdoor.
XZ is a popular data compression format implemented in almost all Linux distributions, including both community-driven and commercial variants.
The malicious discovered by the researchers is obscured and is present only in the download package. The Git distribution doesn’t include the malicious code due to the lack of the M4 macro necessary for triggering the build of the malicious code.
The malicious build interferes with the authentication in sshd through systemd. Under certain conditions, an attacker can compromise sshd authentication and gain unauthorized remote access to the entire system.
CISA also published an advisory urging to downgrade to an uncompromised XZ version (i.e., 5.4.6 Stable) and to hunt for any malicious.
Binarly has created a free scanning tool to help the industry mitigate the threat, the company pointed out that the detection method they use has close to zero false positive rates.
The company states that most of tools that were developed by other experts are focused on simple version checks, hash-based detection of the backdoored component, or YARA rules of the hardcoded unique string constants. These approaches for backdoor detection could lead to false positives.
“To generically detect such implantation, we decided to focus on ifunc transition behavioral analysis with our Binary Intelligence technology. The detection method is completely based on static analysis, where we are detecting generically the tampering of control flow graph transitions” reads the advisory published by the company. “Such detection methods could expose potential control flow tampering during the implantation of malicious ifunc resolvers. This technique works generically and will be able to detect invariants or reuse of the payloads in other software supply chain attacks.”
The XZ backdoor scanner is available for free at XZ.fail, users can upload their binary files to check potential backdoor implantation.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2024-3094)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/161396/security/cve-2024-3094-backdoor-scanner.html