On 29 March 2024, the cybersecurity community turned its attention to a newly disclosed vulnerability in XZ Utils, identified as CVE-2024-3094. This backdoor vulnerability has sent ripples across the tech world, primarily due to the widespread use of XZ Utils for lossless data compression in Linux and macOS systems. This blog aims to demystify CVE-2024-3094, outlining its background, impact, and the steps required for mitigation.

XZ Utils backdoor vulnerability: Background

XZ Utils is an essential software package for developers, offering lossless compression of release tarballs, software packages, kernel images, and initramfs images. Given its utility, XZ Utils is almost ubiquitously installed across Linux and macOS systems for convenience. The discovery of a backdoor in versions 5.6.0 and 5.6.1 of XZ Utils presents a significant security concern, especially for systems with publicly accessible SSH ports.

RedHat has issued a warning about this flaw in XZ Utils, a set of XZ format compression tools commonly found in Linux distributions, indicating it could potentially allow a nefarious individual to compromise sshd authentication and obtain remote unauthorized system access. However, Red Hat also mentioned that fortunately, versions 5.6.0 and 5.6.1 have not been extensively adopted by Linux distributions yet, mainly appearing in pre-release forms.

The malicious versions intentionally interfere with authentication performed by SSH, a commonly used protocol for connecting remotely to systems. SSH provides robust encryption to ensure that only authorized parties connect to a remote system. The backdoor is designed to allow a malicious actor to break the authentication and, from there, gain unauthorized access to the entire system. The backdoor works by injecting code during a key phase of the login process.

The backdoor was deliberately concealed by the developer. It gets incorporated into the binary during the RPM or DEB packaging process for x86-64 architecture, using gcc and gnu linker, under the guise of a "test" step. Consequently, the compromised binary is distributed within the RPM or DEB package.

How the XZ Utils backdoor vulnerability operates

It is a sophisticated backdoor that remains dormant until activated under specific conditions. It leverages the glibc library and exploits systems running vulnerable versions of xz or liblzma. Notably, the backdoor can be triggered by remote, unprivileged systems connecting to public SSH ports, leading to performance issues and potential unauthorized access.

XZ Utils Vulnerability criteria

For a system to be vulnerable to CVE-2024-3094, several conditions must be met:

• The system must use glibc, specifically for IFUNC support.
• XZ Utils version 5.6.0 or 5.6.1, or the corresponding versions of liblzma, must be installed.
• Systems utilizing systemd and a patched version of OpenSSH are known to be vulnerable, though the risk may extend to other configurations pending further analysis.

Who is affected by CVE-2024-3094?

• CISA warns that they have reports of supply chain compromise - https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

Uptycs products are unaffected

Uptcys has confirmed that our products, both the endpoint client software running on customer systems along with our on-premises software and our cloud servers, were not impacted by  CVE-2024-3094 and did not present a risk to our customers or their systems.

CVE-2024-3094: Detection with Uptycs CNAPP

Uptycs has proactively pushed a vulnerability threat book to all of our customers and scanned all of the configured assets. The results of the scan are present on our landing page in the Trending Vulnerabilities card. If any assets are impacted they would surface to the top. If there are no assets impacted it is shown at the end of the list as there is no action to take.

Figure 1 - The vulnerability CVE-2024-3094 in Trending Vulnerabilities Card

Does your system have a vulnerable version of XZ Utils? Uptycs XDR offers robust vulnerability scanning features for timely detection. Uptycs XDR stores vulnerability scan results in a dedicated table, accessible via SQL queries, as shown below:

select cve_list, package_name, package_version, cvss_score, os from vulnerabilities where cve_list = 'CVE-2024-3094'

Figure 2 - Detection of CVE-2024-3094 with vulnerability scan

Conclusion

Uptycs continues to monitor latest and trending threats and provide additional steps for mitigating the threat. It is highly recommended for admins to check if the affected xz library versions are present in any of the assets in their fleet and patch immediately.

SHA256 Hashes:

Suggested further reading:

https://www.uptycs.com/blog/tag/threats