A backdoor was recently discovered in the liblzma software package, a component of the XZ Utils library commonly used for file compression on Linux systems.
Description
This backdoor [1] [2] [3] [4], identified by Microsoft developer Andres Freund [3], enabled unauthorized code execution on devices possessing a specific encryption key [4], circumventing SSHD authentication and potentially allowing complete access to compromised systems. Versions 5.6.0 and 5.6.1 of XZ Utils were affected, impacting users of popular Linux distributions such as Fedora, Debian [1] [2] [3], Kali Linux [1] [2] [4], openSUSE [2], and Arch Linux [2]. Red Hat and Debian promptly responded to the vulnerability, with Red Hat assigning it CVE-2024-3094 and recommending affected organizations to revert to earlier versions of XZ Utils. CISA issued an alert advising Linux developers and users to downgrade to unaffected versions of XZ Utils and conduct thorough checks for any signs of malicious activity in their environments. The backdoor was detected before being fully operational, prompting alerts from security agencies and suggestions to revert to previous versions of XZ Utils. The individual behind the backdoor [3], known as Jia Tan, had been contributing to the project since at least 2022 and eventually assumed a maintainer role, shocking the open source community given the project’s previously trusted and scrutinized status.
Conclusion
The discovery of this backdoor in the XZ Utils library has significant implications for the security of Linux systems, underscoring the importance of vigilance and prompt action in response to such vulnerabilities. The swift responses from Red Hat, Debian [1] [2] [3], and CISA demonstrate the critical role of proactive measures in mitigating potential risks. Moving forward, the open source community must remain vigilant and implement robust security protocols to prevent similar incidents and safeguard the integrity of software libraries.
References
[1] https://www.infosecurity-magazine.com/news/backdoor-xz-utils-linux-open-source/
[2] https://www.techtarget.com/searchsecurity/news/366577602/XZ-backdoor-discovery-reveals-Linux-supply-chain-attack
[3] https://www.theverge.com/2024/4/2/24119342/xz-utils-linux-backdoor-attempt
[4] https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/
