XZ Utils Backdoor (CVE-2024-3094)
What is XZ Utils Backdoor (CVE-2024-3094)?
XZ Utils Backdoor (CVE-2024-3094)A nearly successful 2024 supply-chain attack in which a long-term contributor planted an obfuscated SSH backdoor in the upstream xz/liblzma library shipped by most Linux distributions.
The XZ Utils backdoor (CVE-2024-3094) is a software supply-chain compromise disclosed on 29 March 2024 by Microsoft engineer Andres Freund, who noticed unusual CPU usage and Valgrind errors from sshd on a Debian sid system. Investigation revealed that the xz/liblzma upstream maintainer 'Jia Tan' — a persona that had spent roughly two years building trust on the project — had committed obfuscated build-time scripts that, when packaged on rpm- or deb-based distributions with systemd's libsystemd → liblzma dependency, replaced an OpenSSH-server function via IFUNC resolvers and enabled remote code execution for a holder of a specific Ed448 private key. The malicious code shipped in xz-utils 5.6.0 and 5.6.1 and reached Debian testing/unstable, Fedora 40/41 (Rawhide), openSUSE Tumbleweed, Kali, and Arch, but was caught before most stable releases. The incident reshaped industry thinking about single-maintainer open-source dependencies, IFUNC-based stealth, and the limits of trust in long-tenured contributors.
● Examples
- 01
Andres Freund detected the backdoor after observing sshd taking ~500 ms longer than expected during failed logins on Debian unstable.
- 02
Distributions rolled back xz-utils to 5.4.x and rotated SSH host keys on any system that had briefly run 5.6.0 or 5.6.1.
● Frequently asked questions
What is XZ Utils Backdoor (CVE-2024-3094)?
A nearly successful 2024 supply-chain attack in which a long-term contributor planted an obfuscated SSH backdoor in the upstream xz/liblzma library shipped by most Linux distributions. It belongs to the Attacks & Threats category of cybersecurity.
What does XZ Utils Backdoor (CVE-2024-3094) mean?
A nearly successful 2024 supply-chain attack in which a long-term contributor planted an obfuscated SSH backdoor in the upstream xz/liblzma library shipped by most Linux distributions.
How does XZ Utils Backdoor (CVE-2024-3094) work?
The XZ Utils backdoor (CVE-2024-3094) is a software supply-chain compromise disclosed on 29 March 2024 by Microsoft engineer Andres Freund, who noticed unusual CPU usage and Valgrind errors from sshd on a Debian sid system. Investigation revealed that the xz/liblzma upstream maintainer 'Jia Tan' — a persona that had spent roughly two years building trust on the project — had committed obfuscated build-time scripts that, when packaged on rpm- or deb-based distributions with systemd's libsystemd → liblzma dependency, replaced an OpenSSH-server function via IFUNC resolvers and enabled remote code execution for a holder of a specific Ed448 private key. The malicious code shipped in xz-utils 5.6.0 and 5.6.1 and reached Debian testing/unstable, Fedora 40/41 (Rawhide), openSUSE Tumbleweed, Kali, and Arch, but was caught before most stable releases. The incident reshaped industry thinking about single-maintainer open-source dependencies, IFUNC-based stealth, and the limits of trust in long-tenured contributors.
How do you defend against XZ Utils Backdoor (CVE-2024-3094)?
Defences for XZ Utils Backdoor (CVE-2024-3094) typically combine technical controls and operational practices, as detailed in the full definition above.
What are other names for XZ Utils Backdoor (CVE-2024-3094)?
Common alternative names include: CVE-2024-3094, Jia Tan backdoor, liblzma backdoor.
● Related terms
- attacks№ 1234
Supply Chain Attack
An attack that compromises a trusted third-party software, hardware, or service provider in order to reach its downstream customers.
- appsec№ 1186
Software Supply Chain Security
The discipline of protecting every link of the software production chain - source, dependencies, build, signing, distribution, and deployment - against tampering, malicious code, and integrity loss.
- malware№ 095
Backdoor
A covert mechanism that bypasses normal authentication or access controls to give an attacker future entry to a system.
- network-security№ 1205
SSH
A cryptographic network protocol (RFC 4251, port 22) that provides authenticated, encrypted, and integrity-protected remote login, command execution, and tunneling over an untrusted network.
- attacks№ 719
Malicious npm Package
An npm package that contains hidden code designed to steal data, install malware, or compromise downstream applications when installed.
- appsec№ 335
Dependency Confusion Attack
A supply-chain attack in which an adversary publishes a malicious package on a public registry with the same name as an organization's internal dependency, tricking build tools into pulling the public version.