xz-utils: a backdoor discovered in the Linux build chain

2024-03-29 · Publisher : xz Utils · Domain : Cloud & DevOps

On 29 March 2024, Andres Freund discloses a backdoor (CVE-2024-3094, CVSS 10) in xz versions 5.6.0 and 5.6.1, planted by an infiltrated contributor over several years. It targeted OpenSSH.

### Background On 29 March 2024, engineer Andres Freund posts to the oss-security list his analysis of a backdoor in the liblzma compression library, part of the xz project. He spotted it while investigating why SSH logins used more CPU than expected (about 0.8 s versus 0.3 s) and triggered valgrind errors. Versions 5.6.0 and 5.6.1 are affected; the flaw is assigned CVE-2024-3094. ### Key facts - The malicious code is injected at build time, then hijacks library functions to intercept SSH public-key authentication. - It only activates under specific conditions (x86-64 Linux, GCC compiler, Debian or RPM package build environment). - CVSS score of 10.0, the maximum. - Affected distributions were development or testing branches (Fedora Rawhide and 41, Debian testing and unstable, Kali, openSUSE Tumbleweed, Arch); stable releases had not yet shipped the code. - The "Jia Tan" account had earned the maintainers' trust through a campaign running since 2021, according to public reconstructions. ### Why it matters The attack does not target a company's delivery pipeline but what that pipeline consumes: a low-level dependency, maintained by a volunteer, present in almost every Linux distribution. It was found by chance. For CIOs and build teams, it turned source provenance, maintainer governance and detection of performance anomalies into security topics in their own right. The discovery rests on a gap of a few tenths of a second in an SSH login: performance measurement becomes a security signal in its own right. ### Takeaway A near-miss that became the reference case for open source supply chain threats.

Tags : Sécurité, Open Source, Cloud natif, DevOps