How to fix CVE-2024-3094 – Step-by-Step Guide
CVE-2024-3094, known as the XZ Utils Backdoor, is a critical supply chain vulnerability (CVSS 10) affecting XZ Utils versions 5.6.0 and 5.6.1. This severe issue allows unauthorized remote access, posing a significant threat to affected Linux distributions.
What is XZ Utils Backdoor – Supply Chain Attack?
This vulnerability involves a sophisticated supply chain attack where malicious code was injected into XZ Utils versions 5.6.0 and 5.6.1. The backdoor modifies the liblzma library, enabling unauthorized remote SSH access on systems where sshd is linked against systemd and uses the compromised library. This allows an attacker with a specific private key to bypass authentication.
Impact and Risks for your Infrastructure
The primary impact is unauthorized remote access to compromised systems, leading to potential complete system control and data exfiltration. Any infrastructure running affected XZ Utils versions 5.6.0/5.6.1 with systemd-linked sshd is at critical risk of severe compromise. This could result in significant operational disruption and data breaches.
Step-by-Step Mitigation Guide
Immediately downgrade XZ Utils to version 5.4.6 or upgrade to 5.6.2 or later if available from your distribution. Verify the fix by checking your installed XZ Utils version to ensure it is not 5.6.0 or 5.6.1. Additionally, review system logs for any suspicious SSH activity or unauthorized access attempts.
- 1Downgrade XZ Utils to 5.4.6 or upgrade to 5.6.2+ immediately.
- 2Verify installed version: xz --version
- 3Audit system for indicators of compromise (IoC): check sshd binary hash.
- 4Rotate all SSH keys on affected systems.
- 5Implement software supply chain checks (SBOM, Sigstore, Trivy).
- 6Review and harden your CI/CD pipeline dependency management.