CVE-2024-3094 is a critical Remote Code Execution (RCE) vulnerability found in the popular open-source XZ Utils library. This vulnerability affects XZ Utils versions 5.6.0 and 5.6.1 and could enable unauthorized attackers to gain remote access to affected systems.

About XZ Utils

XZ Utils is very popular on Linux. It supports lossless data compression on almost all Unix-like operating systems, including Linux. XZ Utils includes key utilities for compressing and decompressing data during a variety of tasks. It also supports the legacy. lzma format, which makes this component even more useful.

What Does the Backdoor Do?

The malicious code added to XZ Utils versions 5.6.0 and 5.6.1 changed how the entire software worked. The backdoor manipulated the sshd, the executable file used to establish remote SSH connections. Anyone with a preset encryption key could put any code in an SSH login certificate, upload it, and run it on the backdoored device. No one has seen the code uploaded. Therefore it needs to be clarified what code the attacker intended to run. Theoretically, one could use the code for almost anything, such as acquiring encryption keys or installing malware.

How CVE-2024-3094 was Found?

This cyber incident occurred when a developer from Microsoft noticed that there was a 500-ms delay in the login. He later decided to investigate the cyber incident.

It was discovered that the backdoor was inserted in the XZ Utils library. The upstream XZ repository and the XZ tarballs contained the backdoor, impacting most Linux Unix distributions.

There was a malicious actor (tukaani-project) who was contributing to the open source XZ repository on GitHub and added a backdoor code in the tarballs release. 

However, the GitHub profile of that malicious actor has been removed or maybe deleted.

How to Check if you are affected by XZ Backdoor?

To find out if you are vulnerable to such type of attack, check if you have the affected version of xz. We highly recommend not to run the XZ Utils since this will launch the backdoor and infect your systems. You can run detect.sh on Linux. This is done in order to determine if the system is infected or not.

A former developer introduced harmful code into the source code of XZ Utils, resulting in the vulnerability. This malware uses a sophisticated series of obfuscated malicious code within the XZ Utils source code to disrupt the liblzma library, a key component utilized by OpenSSH for systemd alerts. The complexity of the malicious code made it difficult to detect the vulnerability during typical audits. Once certain conditions meet, a compromised system becomes vulnerable to RCE via SSH authentication bypass, enabling attackers to potentially gain complete control over the system.

Why this Vulnerability(CVE-2024-3094) Matters?

XZ Utils is a fundamental data compression package used in a variety of Linux versions. The severity of this vulnerability arises from its potential to provide attackers with complete control over compromised systems. An attacker may steal sensitive information, install malware, or disrupt vital activities.

Linux Distributions Impacted by Vulnerability

CVE-2024-3094 impacts the following Linux distributions, but the specific affected versions may vary. It’s important to get advice from a skilled cybersecurity expert for the latest information and updated instructions:

Debian: Unstable/sid versions 5.5.1alpha-0.1 up to and including 5.1.1-1

Kali Linux: Systems that received package updates between March 26-29, 2024

OpenSUSE: Tumbleweed and MicroOS rolling releases installed between March 7-28, 2024

Arch Linux: Systems installed on 2024.03.01

Virtual machine images created on 20240301.218094 or 20240315.221711

Container images built between February 24th, 2024 and March 28th, 2024

Fedora: Rawhide and Fedora 40 Beta

Mitigating the Risks of CVE-2024-3094

Here’s what you can do to mitigate the risk of this vulnerability:

• Patch Immediately: Update your XZ Utils library to the latest patched version as soon as possible. One can get help with this from a premium cybersecurity company with pentesting (VAPT) services.
• Verify Integrity: Security researchers recommend verifying the integrity of the downloaded patches before applying them.
• Careful Observation of Third-party Code: This incident highlights the importance of careful examination of third-party code integrated into your systems.

How Kratikal Can Help?

Kratikal is a premium cybersecurity service provider and a Cert-In empaneled company. We offer comprehensive cybersecurity services to help businesses stay secure from critical RCE vulnerabilities like CVE-2024-3094. Our services include:

Vulnerability Assessments & Penetration Testing: We identify and assess vulnerabilities within your systems, including those hidden deep within the software supply chain.

Security Incident Response: In the event of a security breach, Kratikal’s experts can help you contain the damage, reduce the cyber threat, and recover your systems.

Remaining vigilant and informed about vulnerabilities is crucial for organizations to proactively secure their businesses against potential cyber attacks. This enables your businesses to prepare and implement protective measures before hackers can exploit them.

FAQ

The post CVE-2024-3094: RCE Vulnerability Discovered in XZ Utils appeared first on Kratikal Blogs.

*** This is a Security Bloggers Network syndicated blog from Kratikal Blogs authored by Riddika Grover. Read the original post at: https://kratikal.com/blog/cve-2024-3094-rce-vulnerability-discovered-in-xz-utils/