Executive Summary

Informations
Name CVE-2024-3094 First vendor Publication 2024-03-29
Vendor Cve Last vendor Modification 2024-05-01

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Overall CVSS Score 10
Base Score 10 Environmental Score 10
impact SubScore 6 Temporal Score 10
Exploitabality Sub Score 3.9
 
Attack Vector Network Attack Complexity Low
Privileges Required None User Interaction None
Scope Changed Confidentiality Impact High
Integrity Impact High Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3094

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-506 Embedded Malicious Code

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 2

Sources (Detail)

http://www.openwall.com/lists/oss-security/2024/03/29/10
http://www.openwall.com/lists/oss-security/2024/03/29/12
http://www.openwall.com/lists/oss-security/2024/03/29/4
http://www.openwall.com/lists/oss-security/2024/03/29/5
http://www.openwall.com/lists/oss-security/2024/03/29/8
http://www.openwall.com/lists/oss-security/2024/03/30/12
http://www.openwall.com/lists/oss-security/2024/03/30/27
http://www.openwall.com/lists/oss-security/2024/03/30/36
http://www.openwall.com/lists/oss-security/2024/03/30/5
http://www.openwall.com/lists/oss-security/2024/04/16/5
https://access.redhat.com/security/cve/CVE-2024-3094
https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larg...
https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-...
https://aws.amazon.com/security/security-bulletins/AWS-2024-002/
https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz
https://boehs.org/node/everything-i-know-about-the-xz-backdoor
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024
https://bugs.gentoo.org/928134
https://bugzilla.redhat.com/show_bug.cgi?id=2272210
https://bugzilla.suse.com/show_bug.cgi?id=1222124
https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-...
https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27
https://github.com/advisories/GHSA-rxwq-x6h5-x525
https://github.com/amlweems/xzbot
https://github.com/karcherm/xz-malware
https://gynvael.coldwind.pl/?lang=en&id=782
https://lists.debian.org/debian-security-announce/2024/msg00057.html
https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html
https://lwn.net/Articles/967180/
https://news.ycombinator.com/item?id=39865810
https://news.ycombinator.com/item?id=39877267
https://news.ycombinator.com/item?id=39895344
https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/
https://research.swtch.com/xz-script
https://research.swtch.com/xz-timeline
https://security-tracker.debian.org/tracker/CVE-2024-3094
https://security.alpinelinux.org/vuln/CVE-2024-3094
https://security.archlinux.org/CVE-2024-3094
https://security.netapp.com/advisory/ntap-20240402-0001/
https://tukaani.org/xz-backdoor/
https://twitter.com/debian/status/1774219194638409898
https://twitter.com/infosecb/status/1774595540233167206
https://twitter.com/infosecb/status/1774597228864139400
https://twitter.com/LetsDefendIO/status/1774804387417751958
https://ubuntu.com/security/CVE-2024-3094
https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-comp...
https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-b...
https://www.kali.org/blog/about-the-xz-backdoor/
https://www.openwall.com/lists/oss-security/2024/03/29/4
https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users
https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-...
https://www.theregister.com/2024/03/29/malicious_backdoor_xz/
https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094
https://xeiaso.net/notes/2024/xz-vuln/
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
Date Informations
2024-05-02 00:27:31
  • Multiple Updates
2024-05-01 21:27:34
  • Multiple Updates
2024-04-12 13:27:37
  • Multiple Updates
2024-04-03 13:27:25
  • Multiple Updates
2024-04-03 09:27:24
  • Multiple Updates
2024-04-03 05:27:28
  • Multiple Updates
2024-04-02 02:42:18
  • Multiple Updates
2024-04-02 00:27:23
  • Multiple Updates
2024-04-01 21:27:26
  • Multiple Updates
2024-04-01 13:27:28
  • Multiple Updates
2024-04-01 09:27:25
  • Multiple Updates
2024-03-31 09:27:23
  • Multiple Updates
2024-03-31 00:27:24
  • Multiple Updates
2024-03-30 13:27:27
  • Multiple Updates
2024-03-29 21:27:23
  • First insertion