# CVE-2024-3094: Xz: malicious code in distributed source

> CVE-2024-3094 (GitHub advisory GHSA-rxwq-x6h5-x525) is a critical-severity vulnerability with a CVSS 3.1 base score of 10.0, classed as Embedded Malicious Code (CWE-506), in github.com/tukaani-project/xz (Git repository). Affected versions: = 5.6.0; = 5.6.1. No fixed version has been published yet.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2024-3094

| Field | Value |
| --- | --- |
| CVE | CVE-2024-3094 |
| GHSA | GHSA-rxwq-x6h5-x525 |
| Severity | Critical |
| CVSS 3.1 | 10.0 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` (GitHub Advisory Database) |
| CWE | CWE-506 Embedded Malicious Code |
| EPSS | 85.97% (higher than 99.7% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable yes, technical impact total |
| Published | 29 Mar 2024 |
| Modified | 4 Aug 2026 |

## Description

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The tarballs included extra .m4 files, which contained instructions for building with automake that did not exist in the repository. These instructions, through a series of complex obfuscations, extract a prebuilt object file from one of the test archives, which is then used to modify specific functions in the code while building the liblzma package. This issue results in liblzma being used by additional software, like sshd, to provide functionality that will be interpreted by the modified functions.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| https://github.com/tukaani-project/xz | GIT | `pkg:github/tukaani-project/xz` | = 5.6.0; = 5.6.1 | no fix |

## Questions

**What is the GHSA ID for CVE-2024-3094?**

GitHub tracks CVE-2024-3094 as GHSA-rxwq-x6h5-x525.

**What is the CVSS score of CVE-2024-3094?**

CVE-2024-3094 has a CVSS 3.1 base score of 10.0 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

**Which versions are affected by CVE-2024-3094?**

https://github.com/tukaani-project/xz (GIT): = 5.6.0; = 5.6.1.

**How do I fix CVE-2024-3094?**

No fixed version has been published yet. Check the advisory and references for mitigations, and watch the vendor for a release.

**What is the Package URL (PURL) for CVE-2024-3094?**

The affected package's PURL is pkg:github/tukaani-project/xz.

**Is CVE-2024-3094 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2024-3094. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 85.97% chance of exploitation in the next 30 days, higher than 99.7% of CVEs.

## References

- https://access.redhat.com/security/cve/CVE-2024-3094 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3094.json (advisory)
- https://github.com/advisories/GHSA-rxwq-x6h5-x525 (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2024-3094 (advisory)
- https://security.netapp.com/advisory/ntap-20240402-0001/ (advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2272210 (report)
- https://bugzilla.suse.com/show_bug.cgi?id=1222124 (report)
- https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz (article)
- https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/ (article)
- https://www.binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-images (article)
- https://www.kali.org/blog/about-the-xz-backdoor/ (article)
- https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users (article)
- https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils (article)
- https://github.com/amlweems/xzbot (package)
- https://github.com/karcherm/xz-malware (package)
- https://github.com/tukaani-project/xz (package)
- http://www.openwall.com/lists/oss-security/2024/03/29/10
- http://www.openwall.com/lists/oss-security/2024/03/29/12
- http://www.openwall.com/lists/oss-security/2024/03/29/4
- http://www.openwall.com/lists/oss-security/2024/03/29/5
- http://www.openwall.com/lists/oss-security/2024/03/29/8
- http://www.openwall.com/lists/oss-security/2024/03/30/12
- http://www.openwall.com/lists/oss-security/2024/03/30/27
- http://www.openwall.com/lists/oss-security/2024/03/30/36
- http://www.openwall.com/lists/oss-security/2024/03/30/5
- http://www.openwall.com/lists/oss-security/2024/04/16/5
- https://access.redhat.com/downloads/content/package-browser/
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
- https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/
- https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/
- https://aws.amazon.com/security/security-bulletins/AWS-2024-002/
- https://boehs.org/node/everything-i-know-about-the-xz-backdoor
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024
- https://bugs.gentoo.org/928134
- https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405
- https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27
- https://gynvael.coldwind.pl/?lang=en&id=782
- https://lists.debian.org/debian-security-announce/2024/msg00057.html
- https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html
- https://lwn.net/Articles/967180/
- https://news.ycombinator.com/item?id=39865810
- https://news.ycombinator.com/item?id=39877267
- https://news.ycombinator.com/item?id=39895344
- https://research.swtch.com/xz-script
- https://research.swtch.com/xz-timeline
- https://security-tracker.debian.org/tracker/CVE-2024-3094
- https://security.alpinelinux.org/vuln/CVE-2024-3094
- https://security.archlinux.org/CVE-2024-3094
- https://tukaani.org/xz-backdoor/
- https://twitter.com/LetsDefendIO/status/1774804387417751958
- https://twitter.com/debian/status/1774219194638409898
- https://twitter.com/infosecb/status/1774595540233167206
- https://twitter.com/infosecb/status/1774597228864139400
- https://ubuntu.com/security/CVE-2024-3094
- https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094
- https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils
- https://www.theregister.com/2024/03/29/malicious_backdoor_xz/
- https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094
- https://xeiaso.net/notes/2024/xz-vuln/

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2024-3094), compiled from GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.