How to fix CVE-2024-3094 – Step-by-Step Guide
CVE-2024-3094, the XZ Utils Backdoor, is a critical supply chain vulnerability (CVSS 10.0). It involves a malicious backdoor inserted into XZ Utils versions 5.6.0 and 5.6.1. This vulnerability could enable unauthorized remote access to affected systems.
What is XZ Utils Backdoor – Supply Chain Attack?
This critical supply chain attack involved a sophisticated backdoor injected into XZ Utils (liblzma) versions 5.6.0 and 5.6.1. The malicious code modifies the liblzma library. When linked with systemd-enabled sshd, it allows a malicious actor to bypass SSH authentication, granting unauthorized remote access.
Impact and Risks for your Infrastructure
The primary impact is unauthorized remote access to compromised systems, leading to potential data exfiltration, system takeover, and further network compromise. While critical, the backdoor was discovered early, limiting widespread exploitation. Organizations should prioritize immediate remediation to prevent potential breaches.
Step-by-Step Mitigation Guide
To mitigate, downgrade XZ Utils to version 5.4.6 or upgrade to 5.6.2 or later if available from your distribution. Verify the installed XZ Utils version using `xz --version` or by checking package manager logs. Ensure your system's `sshd` is not linked against the vulnerable `liblzma` versions.
- 1Downgrade XZ Utils to 5.4.6 or upgrade to 5.6.2+ immediately.
- 2Verify installed version: xz --version
- 3Audit system for indicators of compromise (IoC): check sshd binary hash.
- 4Rotate all SSH keys on affected systems.
- 5Implement software supply chain checks (SBOM, Sigstore, Trivy).
- 6Review and harden your CI/CD pipeline dependency management.