Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Brief: Vulnerability in XZ Utils Data Compression Library Impacting Multiple Linux Distributions (CVE-2024-3094)

Summary: On March 28, 2024, Red Hat announced CVE-2024-3094, a supply chain compromise in XZ Utils versions 5.6.0 and 5.6.1 rated a critical CVSS score of 10, in which malicious code modifies functions during the liblzma build process and may allow unauthorized access to affected systems. Security researcher Andres Freund found the code after observing failing ssh logins with high CPU loads and slower logins, and CISA advised downgrading to a version earlier than 5.6.0.

Key Takeaway: The backdoor reached Debian testing, unstable and experimental distributions from 5.5.1alpha-0.1 (uploaded 2024-02-01) through 5.6.1-1, Kali between March 26-29, OpenSUSE Tumbleweed and Micro OS between March 7 and March 28, and Arch container images created between 2024-02-24 and 2024-03-28 - so any build or image pulled in that window needs to be checked against the version, not assumed clean.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Data Breaches
Mentions
CVE-2024-3094
Related