How to fix CVE-2024-3094 – Step-by-Step Guide
CVE-2024-3094, known as the XZ Utils Backdoor, is a critical supply chain vulnerability (CVSS 10.0). It involves malicious code inserted into XZ Utils versions 5.6.0 and 5.6.1. This backdoor could enable unauthorized remote access to affected systems.
What is XZ Utils Backdoor – Supply Chain Attack?
A sophisticated supply chain attack introduced a backdoor into XZ Utils (liblzma) versions 5.6.0 and 5.6.1. A compromised maintainer inserted malicious code that, when executed, manipulates SSH authentication. Specifically, it allows an attacker with a specific private key to gain unauthorized access via systemd-linked sshd. This bypasses standard authentication mechanisms.
Impact and Risks for your Infrastructure
The primary impact is unauthorized remote access to affected systems. Any system running XZ Utils 5.6.0 or 5.6.1 with systemd-linked sshd is vulnerable to complete system compromise. While extremely severe, the backdoor was discovered before widespread deployment, limiting its potential real-world impact.
Step-by-Step Mitigation Guide
Immediately downgrade XZ Utils to version 5.4.6 or upgrade to version 5.6.2 or later. Verify that your system is running a safe version of XZ Utils/liblzma. Check for any unusual SSH activity or system modifications as a precaution.
- 1Downgrade XZ Utils to 5.4.6 or upgrade to 5.6.2+ immediately.
- 2Verify installed version: xz --version
- 3Audit system for indicators of compromise (IoC): check sshd binary hash.
- 4Rotate all SSH keys on affected systems.
- 5Implement software supply chain checks (SBOM, Sigstore, Trivy).
- 6Review and harden your CI/CD pipeline dependency management.