Skip to content

CVE-2024-3094 Xz: malicious code in distributed source

CriticalCVSS 10.0 EPSS 90.9% PoC
Published
Updated
Exploit status
Proof-of-concept only
Sign in for asset impact Search another CVE

Description

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Affected products

ProductAffected versionsFixed in
debian/xz-utils(Debian:13) < 5.6.1+really5.4.5-1 5.6.1+really5.4.5-1
debian/xz-utils(Debian:14) < 5.6.1+really5.4.5-1 5.6.1+really5.4.5-1
xz = 5.6.0 No fix listed
xz = 5.6.1 No fix listed
redhat enterprise linux = 10 No fix listed
redhat rhel els = 6 No fix listed
redhat rhel els = 7 No fix listed
redhat enterprise linux = 8 No fix listed
redhat enterprise linux = 9 No fix listed
redhat jboss enterprise application platform = 8 No fix listed
alpine/lighttpd(Alpine:v3.15) < 1.4.76-r0 1.4.76-r0
alpine/lighttpd(Alpine:v3.16) < 1.4.76-r0 1.4.76-r0
alpine/lighttpd(Alpine:v3.17) < 1.4.76-r0 1.4.76-r0
alpine/lighttpd(Alpine:v3.18) < 1.4.76-r0 1.4.76-r0
alpine/xz(Alpine:v3.20) < 5.6.1-r2 5.6.1-r2
alpine/xz(Alpine:v3.21) < 5.6.1-r2 5.6.1-r2
alpine/xz(Alpine:v3.22) < 5.6.1-r2 5.6.1-r2
alpine/xz(Alpine:v3.23) < 5.6.1-r2 5.6.1-r2
alpine/xz(Alpine:v3.24) < 5.6.1-r2 5.6.1-r2
tukaani xz = 5.6.0 No fix listed
tukaani xz = 5.6.1 No fix listed

References