XZ Struck By Malicious Code That Could Allow Unauthorized Remote System Access
Red Hat cites CVE-2024-3094 for this XZ security vulnerability due to malicious code making it into the codebase. I haven't seen CVE-2024-3094 made public yet but the Red Hat security alert sums it up as:
"The malicious injection present in the xz versions 5.6.0 and 5.6.1 libraries is obfuscated and only included in full in the download package - the Git distribution lacks the M4 macro that triggers the build of the malicious code. The second-stage artifacts are present in the Git repository for the injection during the build time, in case the malicious M4 macro is present.
The resulting malicious build interferes with authentication in sshd via systemd. SSH is a commonly used protocol for connecting remotely to systems, and sshd is the service that allows access. Under the right circumstances this interference could potentially enable a malicious actor to break sshd authentication and gain unauthorized access to the entire system remotely."
Ouch! XZ 5.6 debuted one month ago and XZ 5.6.1 came out three weeks ago. As of writing, no XZ 5.6.2 or similar released version is yet available with the malicious code removed.
The urgent Red Hat warning can be found via the Red Hat blog. Debian has also released a similar security message over the malicious code within XZ utils.
Long story short, make sure you don't have XZ 5.6.0/5.6.1 on your systems now.
Update: Additional information now available on the oss-security list with the discover by Andres Freund.
252 Comments
