What is CVE-2024-3094?

A malicious backdoor was inserted into XZ Utils 5.6.0 and 5.6.1 by a compromised maintainer, enabling unauthorized SSH access via systemd on affected systems.

How do I fix CVE-2024-3094?

Downgrade XZ Utils to 5.4.6 or upgrade to 5.6.2+ immediately. Verify installed version: xz --version Audit system for indicators of compromise (IoC): check sshd binary hash. Rotate all SSH keys on affected systems. Implement software supply chain checks (SBOM, Sigstore, Trivy). Review and harden your CI/CD pipeline dependency management.

Which versions are affected by CVE-2024-3094?

Affected: XZ Utils 5.6.0, 5.6.1. Fixed in: XZ Utils 5.4.6 (downgrade) or 5.6.2+.

criticalCVSS 10/10·Published: 2024-03-29·XZ Utils (liblzma)

How to fix CVE-2024-3094 – Step-by-Step Guide

CVE-2024-3094 details a critical supply chain attack involving XZ Utils versions 5.6.0 and 5.6.1. This vulnerability, rated CVSS 10.0, introduces a backdoor enabling unauthorized remote access.

CVE ID

CVE-2024-3094

Severity

CRITICAL

CVSS Score

10/10

Affected

XZ Utils (liblzma)

What is XZ Utils Backdoor – Supply Chain Attack?

A sophisticated backdoor was maliciously inserted into XZ Utils versions 5.6.0 and 5.6.1. This backdoor, within the liblzma library, specifically targets systems using systemd-linked sshd. It allows a remote attacker to gain unauthorized SSH access to the compromised system.

Affected Versions

XZ Utils 5.6.0, 5.6.1

Fixed In

XZ Utils 5.4.6 (downgrade) or 5.6.2+

Official References

Impact and Risks for your Infrastructure

The primary impact is unauthorized remote access to affected systems running XZ Utils 5.6.0/5.6.1 with systemd-linked sshd. This could lead to complete system compromise, data exfiltration, or further network penetration. While discovered early, the potential for severe infrastructure compromise was critical.

xz-utilssupply-chaincriticallinuxbackdoor2024

Step-by-Step Mitigation Guide

Immediately identify and downgrade XZ Utils to version 5.4.6 or upgrade to 5.6.2+. Verify your system's XZ Utils version using `xz --version` or by checking package manager logs. Ensure no affected versions (5.6.0, 5.6.1) remain active on any system.

1Downgrade XZ Utils to 5.4.6 or upgrade to 5.6.2+ immediately.
2Verify installed version: xz --version
3Audit system for indicators of compromise (IoC): check sshd binary hash.
4Rotate all SSH keys on affected systems.
5Implement software supply chain checks (SBOM, Sigstore, Trivy).
6Review and harden your CI/CD pipeline dependency management.

Frequently Asked Questions

What is the CVSS score for CVE-2024-3094?▼

CVE-2024-3094 has a CVSS score of 10/10 (critical severity). This reflects the most severe potential impact, requiring immediate remediation.

Which versions of XZ Utils (liblzma) are affected?▼

Affected: XZ Utils 5.6.0, 5.6.1. The vulnerability was fixed in: XZ Utils 5.4.6 (downgrade) or 5.6.2+.

How long does it take to fix CVE-2024-3094?▼

For most teams: 15–60 minutes to apply the patch, plus 15 minutes of post-patch verification. Complex multi-service environments may require 2–4 hours including staging validation.

Is CVE-2024-3094 being actively exploited?▼

Check the NVD entry and CISA KEV catalog for exploitation status. As a critical-severity vulnerability, treat it as a priority remediation regardless of known exploitation status.

Run Security Check →Browse Runbooks →← All CVE Solutions

This CVE fix guide is based on publicly available security advisories (NVD, vendor bulletins). Always test changes in a staging environment before applying to production. Verify against the official vendor advisory for the most up-to-date guidance.