Brand ClaimErleben, was verbindet

Information on the use of cookies

This website uses only the technically necessary cookies to provide you with the best possible service.
Your session is identified by a so-called session cookie in order to maintain your language choice and to allow a comfortable form use. Furthermore, a login is only possible by using a cookie.
Further information can be found in the data protection information.

Accept

Advisory 2024-0684 - xz: Vulnerability allows execution of arbitrary code

Notice: You can now also find information from the Vulnerability Advisory Service in the CTI portal!
The CTI portal is available at the following address: https://cti-portal.telekom.net/advisories/2024-0684
Notice: This advisory is by exception shown completely public. You will regularly receive details on vulnerability information as a customer via your login or through our daily advisory e-mail.
5
Attack probability
high
5
Potential damage
high
remote anonymous attackerExploit available
Date
2024-04-02
Release
2024-04-02

Operating System

  • Linux

Software

  • Debian Linux unstable
  • Fedora Linux
  • Gentoo Linux
  • Open Source Arch Linux
  • Open Source OpenSSH
  • Open Source xz 5.6.0
  • Open Source xz 5.6.1
  • SUSE Linux MicroOS
  • SUSE Linux Tumbleweed

Attack

A remote anonymous attacker can exploit a vulnerability in xz in order to execute arbitrary code.

Description

XZ Utils provide a general-purpose data-compression library plus command-line tools.

CVE-2024-3094

There is a vulnerability in xz due to embedded malicious code that creates a backdoor. Among others, this library is used in OpenSSH server. The backdoor code allows certain remote attackers (possessing a certain private key) to send arbitrary payloads via SSH that are executed on the server before the authentication step. A remote, anonymous attacker can exploit this vulnerability to execute arbitrary program code with the rights of the SSH service and thus compromise the system.

CVSSv2 Base Score: 10.0 / Temporal Score: 7.8
AV:N/AC:L/AU:N/C:C/I:C/A:C/E:POC/RL:OF/RC:ND
CVSSv3.1 Base Score: 10.0 / Temporal Score: 9.0
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:X

PoC code taking advantage of the vulnerability CVE-2024-3094 is available on the Internet.

Recommendation

Debian provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://lists.debian.org/debian-security-announce/2024/msg00057.html

openSUSE provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://news.opensuse.org/2024/03/29/xz-backdoor/

Arch Linux provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://security.archlinux.org/ASA-202403-1

Fedora provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-d02c7bb266.

tukaani.org provides updates. Please update your installation and see the vendors advisory to find the proper version suitable for your environment.
https://www.openwall.com/lists/oss-security/2024/03/29/4

Gentoo provides updates. Please update your installation and see the vendors advisory to find the proper version suitable for your environment.
https://security.gentoo.org/glsa/202403-04

Information

Red Hat Security Alert dated 2024-04-01
https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users

GitHub Advisory Database
https://github.com/advisories/GHSA-rxwq-x6h5-x525

Red Hat Bugzilla – Bug 2272210
https://bugzilla.redhat.com/show_bug.cgi?id=2272210

CISA Report
https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

Statement by the author of xz
https://tukaani.org/xz-backdoor/

Proof of Concept (PoC)
https://github.com/amlweems/xzbot

References

ARCHLINUX:ASA-202403-1
CVE:CVE-2024-3094
DEBIAN:DSA-5649
FEDORA:FEDORA-2024-D02C7BB266
GENTOO:GLSA-202403-04
GITHUB:GHSA-RXWQ-X6H5-X525
QNAP:QSA-24-19
QUALYS:379548
REDHAT-BUG:2272210
SYNOLOGY:SYNOLOGY-SA-24:06

Disclaimer

*The probability of an attack is determined by the attacker's motivation, the necessary expend and the possibilities for an attack. The damage probability is determined by the expend needed to resolute the attack and probable indirect consequences of an attack for business processes. Telekom Security assumes worst case scenarios.

Copyright © 1999-2026 Deutsche Telekom Security GmbH. All rights reserved. Reproduction and distribution of this publication in any form - even in parts - without prior written permission is forbidden.

The information contained herein has been obtained from sources believed to be reliable and trusted or have been verified. Telekom Security can take liability for completeness, accuracy and correctness only in so far, as gross negligence or intention create liability. Any liability beyond it, in particular possible damages resulting from using or non-usability of the information contained herein, is excluded.