A critical vulnerability, CVE-2024-3094, has been discovered in the xz data compression software, specifically in versions 5.6.0 and 5.6.1. This vulnerability allows malicious actors to gain remote access to affected systems, potentially impacting a variety of Linux distributions and other operating systems. The severity of this vulnerability is rated as 10.0 CRITICAL, and users are urged to downgrade to a safer version of the software to mitigate the risk. While the exact types of systems affected are not explicitly listed, any system using the compromised versions of xz could be at risk.

How do I know if I'm affected?

If you're wondering whether your system is affected by the vulnerability, you'll need to check if you're using xz versions 5.6.0 or 5.6.1. To do this, run the command xz --version on your system. If the output shows xz (XZ Utils) 5.6.1 or liblzma 5.6.1, your system is affected. Keep in mind that certain Linux distributions, such as Fedora 41 and Fedora Rawhide, as well as Debian testing, unstable, and experimental distributions, may have compromised packages. Kali Linux users who updated their installation between March 26th and March 29th may also be affected.

What should I do if I'm affected?

If you're affected by the vulnerability, immediately stop using the compromised xz versions and downgrade to a safer version, such as XZ Utils 5.4.6 Stable. For example, MacOS users can run 'brew upgrade' to downgrade xz. Users of Fedora, openSUSE, Debian, and Kali Linux should follow their respective distribution's update instructions to mitigate the risk.

Is CVE-2024-3094 in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, it is in CISA's Known Exploited Vulnerabilities Catalog. This security issue, related to malicious code in xz compression software versions 5.6.0 and 5.6.1, was added to the catalog on March 29, 2024. However, the due date and required action are not provided. In simple terms, this vulnerability allows unauthorized remote access to affected systems, posing a significant risk to users.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-506. This backdoor allows unauthorized remote access to affected systems, and users should downgrade to a safer version.

For more details

CVE-2024-3094 is a critical vulnerability in xz compression software, affecting versions 5.6.0 and 5.6.1. This backdoor allows unauthorized remote access to impacted systems, posing a significant risk to users. For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the links below.

• Are You Affected by the Backdoor in XZ Utils?

• xz Backdoor CVE-2024-3094

• Beware! Backdoor found in XZ utilities used by many Linux distros (CVE-2024-3094)

• Malicious SSH backdoor sneaks into xz, Linux world's data compression library