Frequently asked questions about CVE-2024-3094, a supply-chain attack responsible for a backdoor in XZ Utils, a widely used library found in multiple Linux distributions.

Frequently Asked Questions About CVE-2024-3094, A Backdoor in XZ Utils

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

The version of XZ Utils installed on the remote host is potentially affected by a backdoor vulnerability.

Note: This plugin is paranoid because not all instances of the affected versions of XZ Utils are known to be vulnerable to the backdoor. The method of installation of XZ Utils plays a role in whether the install is vulnerable or not. However, multiple vendors have rolled out remediation fixes as a precaution.

Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

As this detection can lead to potential false positives, it is recommended that manual verification of identified instances be performed.

For more information, refer to https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils

The remote host is affected by the vulnerability described in GLSA-202403-04 (XZ utils: Backdoor in release tarballs)

  - Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a     series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised     test file existing in the source code, which is then used to modify specific functions in the liblzma     code. This results in a modified liblzma library that can be used by any software linked against this     library, intercepting and modifying the data interaction with this library. (CVE-2024-3094)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The XZ Utils installed on the remote host is affected by a backdoor ssh vulnerability.

ID	Name	Product	Family	Severity
192737	XZ Utils 5.6.0 / 5.6.1 Liblzma Backdoor Check	Nessus	Misc.	critical
192734	GLSA-202403-04 : XZ utils: Backdoor in release tarballs	Nessus	Gentoo Local Security Checks	critical
192708	Potential exposure to XZ Utils SSH Backdoor (CVE-2024-3094)	Nessus	Misc.	critical

Detections

Analytics

CVE-2024-3094

critical

Tenable Plugins

critical

critical

critical