← All articles CVE · CRITICAL · CVSS 10.0

The xz-utils backdoor
(CVE-2024-3094):
what a network scan
can and cannot detect

In March 2024, Andres Freund (PostgreSQL developer) accidentally discovered that xz-utils versions 5.6.0 and 5.6.1 contain a backdoor introduced by a contributor (jiaT75) who won the project's trust after about two years of contributions.

How the backdoor works

The execution chain:

1. In distributions that patch sshd (OpenSSH) to use libsystemd, sshd loads liblzma, the xz-utils library, indirectly
2. At build time: in the release tarballs, build-to-host.m4 extracts an obfuscated payload from seemingly corrupt test files
3. At runtime: liblzma.so.5 hooks RSA_public_decrypt via the ifunc resolver
4. When the client's SSH key is verified, if the data received contains a payload signed with the attacker's key (Ed448), code is executed before authentication

Impact: pre-authentication remote code execution (RCE) on systems running 5.6.0 or 5.6.1 from distributions' development branches, with sshd linked to liblzma.

Affected versions

• xz-utils 5.6.0 (released 2024-02-24)
• xz-utils 5.6.1 (released 2024-03-09)

Affected distributions (at the time of publication):

• Fedora 40 + 41 testing
• openSUSE Tumbleweed
• Kali Linux rolling (rare cases)
• Debian unstable / sid

NOT affected (stable channels): Debian stable, Ubuntu LTS, RHEL, AlmaLinux, Rocky Linux.

What a network scan can and cannot show

Network Scan (10 credits) takes an IP address or a network and has no access to the host. It finds the exposed ports and runs Nuclei templates for known CVEs (public vulnerability identifiers) against them.

The SSH banner shows the OpenSSH version and sometimes the distribution, but not the liblzma version. From the outside you cannot tell whether a host runs xz-utils 5.6.0 or 5.6.1, so a network scan cannot confirm or rule out this backdoor on its own. It shows you where SSH is exposed, so you know which hosts to check locally:

xz --version
ldd $(command -v sshd) | grep lzma

If xz --version shows 5.6.0 or 5.6.1, move on to remediation. If sshd does not appear linked to liblzma, the attack path described above does not apply, but the affected version still has to be replaced.

Remediation

Recommended steps:

1. Urgently install the xz-utils package fixed by your distribution (upstream: 5.6.2 or later)
2. Restart sshd after changing the package
3. If you ran the affected versions on a host exposed to the Internet, treat it as potentially compromised and review the authentication logs
4. Run a Network Scan on your perimeter to see which SSH services you expose

The bigger lesson

The jiaT75 attack is the textbook case for software supply-chain integrity. What helps:

• An inventory of dependencies (SBOM, software bill of materials)
• Verification of maintainer signatures through webs of trust
• Reproducible builds (for example Tor, NixOS)