How to fix CVE-2024-3094 – Step-by-Step Guide
CVE-2024-3094, known as the XZ Utils Backdoor, is a critical supply chain vulnerability (CVSS 10) affecting XZ Utils versions 5.6.0 and 5.6.1. This severe issue involves a malicious backdoor inserted into the liblzma library, potentially allowing unauthorized remote access.
What is XZ Utils Backdoor – Supply Chain Attack?
This vulnerability stems from a sophisticated supply chain attack where malicious code was injected into XZ Utils 5.6.0 and 5.6.1. The backdoor specifically targets systems using systemd-linked sshd, modifying the OpenSSH server's authentication process. It allows a malicious actor with a specific key to gain unauthorized remote access to the compromised system.
Impact and Risks for your Infrastructure
The primary impact is unauthorized remote access to affected systems running XZ Utils 5.6.0 or 5.6.1 with systemd-linked sshd. This critical flaw (CVSS 10) could lead to complete system compromise, data exfiltration, or further network penetration. While discovered early, unpatched systems face severe security risks.
Step-by-Step Mitigation Guide
Immediately downgrade XZ Utils to version 5.4.6 or upgrade to 5.6.2+. Verify your current XZ Utils version using `xz --version`. Ensure that your system is not running versions 5.6.0 or 5.6.1. After updating, restart relevant services or the system to apply the fix and confirm the correct version is active.
- 1Downgrade XZ Utils to 5.4.6 or upgrade to 5.6.2+ immediately.
- 2Verify installed version: xz --version
- 3Audit system for indicators of compromise (IoC): check sshd binary hash.
- 4Rotate all SSH keys on affected systems.
- 5Implement software supply chain checks (SBOM, Sigstore, Trivy).
- 6Review and harden your CI/CD pipeline dependency management.