Perform validation as soon as possible! The "XZ Utils" vulnerability (CVE-2024-3094) that everyone is talking about has now been added to the Cyritex simulation attack library

Researchers have discovered a malicious backdoor in a compression tool that made its way into widely used Linux distributions, including those from Red Hat and Debian.

According to developer Andres Freund, who discovered the vulnerability, the compression tool, named xz Utils, introduced malicious code in versions 5.6.0 and 5.6.1. Currently, there are no reports of these versions being integrated into any major production Linux distributions, but both Red Hat and Debian reported that recently released beta distributions used at least one backdoored version — specifically in Fedora Rawhide and Debian's testing, unstable, and experimental distributions. The stable version of Arch Linux is also affected, but this version is not used in production systems.

Because this backdoor was discovered before the malicious versions of xz Utils were added to production versions of Linux, it reportedly did not actually affect anyone in the real world, only because the attacker was too sloppy and got caught early. If it had gone undetected, the consequences would have been catastrophic.

Some have reported that multiple applications included in macOS's HomeBrew package manager rely on the backdoored version 5.6.1 of xz Utils. HomeBrew has now rolled back the tool to version 5.4.6.

▌Targeting sshd

Red Hat officials said the first signs of the backdoor were introduced in an update on 23 February that added obfuscated code. An update the next day included a malicious installation script that injected itself into the functions used by sshd, the binary that makes SSH work. The malicious code is only present in the archived versions (referred to as tarballs) that are released upstream. The so-called GIT code available in the repository is unaffected, although they include second-stage artifacts that allow injection during build. If the obfuscated code introduced on 23 February is present, the artifacts in the GIT version will allow the backdoor to run.

These malicious modifications were committed by JiaT75, one of two main developers who have contributed to the xz Utils project for years.

Given the activity over these weeks, the committer was either directly involved or their system was rather severely compromised. Based on various recent communications regarding requests for "fixes", the compromise could be quite extensive.

On 21 March, someone using the developer's name visited the Ubuntu developer site, requesting that the backdoored version 5.6.1 be merged into the production version because it fixed bugs causing the Valgrind tool to malfunction.

"This might break build scripts and test pipelines that need a specific output of Valgrind to pass," the person warned from an account created on the same day.

A Fedora maintainer said last Friday that the developer had approached them in recent weeks, requesting that Fedora 40 (beta) include a backdoored version of the utility.

"We even worked with him to resolve the valgrind issue (which is now proven to be caused by the backdoor he added)," said the Ubuntu maintainer. "He has been involved in the xz project for two years, adding various binary test files, and with this level of sophistication, we would even be suspicious of older versions of xz unless proven otherwise."

The maintainers of xz Utils did not immediately reply to emails seeking questions.

Researchers said the malicious versions deliberately interfere with authentication performed by SSH, a common protocol for connecting to systems remotely. SSH provides strong encryption to ensure that only authorised parties can connect to remote systems. The backdoor is designed to allow a malicious attacker to break authentication, and from there gain unauthorised access to the entire system. The backdoor works by injecting code at critical stages of the login process.

"I haven't yet analysed exactly what is being checked in the injected code to allow unauthorised access," Freund said. "Since this runs in a pre-authentication context, it seems likely to allow some form of access or other form of remote code execution."

Researchers reverse-engineering the update said the backdoor injected malicious code during SSH operations rather than bypassing authentication.

In some cases, the backdoor did not work as expected. For example, the build environment on Fedora 40 contained incompatibilities that caused the injection to not occur properly. Fedora 40 has now reverted to the 5.4.x version of xz Utils.

Xz Utils is available for most Linux distributions, but is not included by default in all of them. Anyone using Linux should contact their distributor immediately to determine if their system is affected. Freund has provided a script to detect SSH systems for vulnerability.

Attack simulation rules targeting this malicious backdoor have been added to the Security Gauge Validation Platform. If you are unsure whether your system is affected, you can search for the keywords "XZ" or "CVE-2024-3094" in the Security Gauge Validation Platform to obtain relevant attack simulation validation actions, thereby verifying whether your security defense system can effectively cope with this malicious backdoor. The platform ensures your validation process is safe and harmless in an industry-unique way.