CVE-2024-3094

Published Mar 29, 2024

Last updated 9 days ago

CVSS critical 10.0

Ubuntu

SSH

Cloud

Network

Zero-day

Container Security

System

Supply chain

Server

Port (22)

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-3094 refers to a supply chain compromise discovered in versions 5.6.0 and 5.6.1 of XZ Utils, a widely used data compression software found in major Linux distributions. Malicious code was surreptitiously introduced into the upstream tarballs of XZ Utils. Through a series of complex obfuscations, the build process for the `liblzma` library (a core component of XZ Utils) extracts a prebuilt object file from a disguised test file within the source code. This object file then modifies specific functions within the `liblzma` code. This modification results in a compromised `liblzma` library that can be leveraged by any software linked against it. Specifically, the malicious code targets the OpenSSH server (SSHD) process, allowing a remote attacker with a specific private key to send arbitrary payloads that are executed before the authentication step, potentially leading to unauthorized remote code execution. The vulnerability was discovered on March 28, 2024, by Andres Freund, who noticed unusual CPU usage and errors related to `liblzma` during SSH logins.

Description: Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Source: secalert@redhat.com
NVD status: Modified
Products: xz

Insights

Analysis from the Intruder Security Team

Published Oct 15, 2024

The attack is believed to be a nation-state level attack, and only the rogue developer and groups with which the compromised key has been shared would be able to gain access. As such, it is not likely to be widely exploited.

More information is available in our blog post here.

Risk scores

CVSS 3.1

Type: Primary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

secalert@redhat.com: CWE-506

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "73F1DAD7-F362-4C5B-B980-2E5313C369DA",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*",
            "matchCriteriaId": "55782A0B-B9C5-4536-A885-84CAB7029C09",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.