CVE-2024-3094: Xz: malicious code in distributed source

NVD analysis

Status

Modified

Published

2024-03-29T17:15:21.150

Last modified

2026-06-17T07:43:17.830

Weaknesses

CWE-506

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

References

• https://access.redhat.com/security/cve/CVE-2024-3094 (Vendor Advisory)
• https://bugzilla.redhat.com/show_bug.cgi?id=2272210 (Issue Tracking, Vendor Advisory)
• https://www.openwall.com/lists/oss-security/2024/03/29/4 (Mailing List)
• https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users (Vendor Advisory)
• http://www.openwall.com/lists/oss-security/2024/03/29/10
• http://www.openwall.com/lists/oss-security/2024/03/29/12
• http://www.openwall.com/lists/oss-security/2024/03/29/4
• http://www.openwall.com/lists/oss-security/2024/03/29/5
• http://www.openwall.com/lists/oss-security/2024/03/29/8
• http://www.openwall.com/lists/oss-security/2024/03/30/12
• http://www.openwall.com/lists/oss-security/2024/03/30/27
• http://www.openwall.com/lists/oss-security/2024/03/30/36
• http://www.openwall.com/lists/oss-security/2024/03/30/5
• http://www.openwall.com/lists/oss-security/2024/04/16/5
• https://access.redhat.com/security/cve/CVE-2024-3094 (Vendor Advisory)
• https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/
• https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/ (Third Party Advisory)
• https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ (Third Party Advisory)
• https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz
• https://boehs.org/node/everything-i-know-about-the-xz-backdoor (Third Party Advisory)
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 (Mailing List, Vendor Advisory)
• https://bugs.gentoo.org/928134 (Issue Tracking, Third Party Advisory)
• https://bugzilla.redhat.com/show_bug.cgi?id=2272210 (Issue Tracking, Vendor Advisory)
• https://bugzilla.suse.com/show_bug.cgi?id=1222124 (Issue Tracking, Third Party Advisory)
• https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405 (Third Party Advisory)
• https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 (Third Party Advisory)
• https://github.com/advisories/GHSA-rxwq-x6h5-x525 (Third Party Advisory)
• https://github.com/amlweems/xzbot
• https://github.com/karcherm/xz-malware (Third Party Advisory)
• https://gynvael.coldwind.pl/?lang=en&id=782 (Technical Description, Third Party Advisory)
• https://lists.debian.org/debian-security-announce/2024/msg00057.html (Mailing List, Third Party Advisory)
• https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html (Third Party Advisory)
• https://lwn.net/Articles/967180/ (Issue Tracking, Third Party Advisory)
• https://news.ycombinator.com/item?id=39865810 (Issue Tracking, Third Party Advisory)
• https://news.ycombinator.com/item?id=39877267 (Issue Tracking)
• https://news.ycombinator.com/item?id=39895344
• https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/ (Third Party Advisory)
• https://research.swtch.com/xz-script
• https://research.swtch.com/xz-timeline
• https://security-tracker.debian.org/tracker/CVE-2024-3094 (Third Party Advisory)
• https://security.alpinelinux.org/vuln/CVE-2024-3094 (Third Party Advisory)
• https://security.archlinux.org/CVE-2024-3094 (Third Party Advisory)
• https://security.netapp.com/advisory/ntap-20240402-0001/
• https://tukaani.org/xz-backdoor/ (Issue Tracking, Vendor Advisory)
• https://twitter.com/LetsDefendIO/status/1774804387417751958 (Third Party Advisory)
• https://twitter.com/debian/status/1774219194638409898 (Press/Media Coverage)
• https://twitter.com/infosecb/status/1774595540233167206 (Press/Media Coverage)
• https://twitter.com/infosecb/status/1774597228864139400 (Press/Media Coverage)
• https://ubuntu.com/security/CVE-2024-3094 (Third Party Advisory)
• https://www.binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-images
• https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 (Third Party Advisory, US Government Resource)
• https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils (Third Party Advisory)
• https://www.kali.org/blog/about-the-xz-backdoor/
• https://www.openwall.com/lists/oss-security/2024/03/29/4 (Mailing List)
• https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users (Vendor Advisory)
• https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils (Third Party Advisory)
• https://www.theregister.com/2024/03/29/malicious_backdoor_xz/ (Press/Media Coverage)
• https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094
• https://xeiaso.net/notes/2024/xz-vuln/ (Third Party Advisory)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-03T01:45:06.099Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-3094

CVE record

Title (CNA)

Xz: malicious code in distributed source

Assigner

redhat

State

PUBLISHED

Published

2024-03-29T16:51:12.588Z

Updated

2026-08-04T07:05:54.671Z

Problem types

Embedded Malicious Code

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

References

• https://access.redhat.com/security/cve/CVE-2024-3094
• RHBZ#2272210
• https://www.openwall.com/lists/oss-security/2024/03/29/4
• https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users

Read on 2026-11-03T02:06:21.660Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/3xxx/CVE-2024-3094.json

Detection rules (SigmaHQ)

SigmaHQ rules whose own tags name this CVE. Each rule page shows the rule as its author published it.

• Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process (status test, level high)

Defensive techniques (MITRE D3FEND)

D3FEND maps these defensive techniques to the weakness (CWE) that NVD lists for this CVE, through the digital artifacts the weakness affects. D3FEND does not say they stop this vulnerability.

MITRE D3FEND™ knowledge graph. © 2025 The MITRE Corporation.
"The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use D3FEND for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." Terms: https://d3fend.mitre.org/tou/