{"id":"CVE-2024-3094","published":"2024-03-29T16:51:12Z","modified":"2026-08-04T07:05:54Z","title":"Xz: malicious code in distributed source","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","tier":"core","eol":null,"affectedVersions":[{"vendor":null,"product":null,"versions":["5.6.0","5.6.1"]}],"description":{"text":"Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.","provenance":"source","from":"CVE.org"},"summary":{"text":"The xz liblzma library, as shipped in the upstream xz source tarballs starting with version 5.6.0 and affecting Red Hat Enterprise Linux 10, contains malicious code: its build process extracts a prebuilt object file from a disguised test file and uses it to modify specific liblzma functions. Any software linked against the tampered library can have its data interactions intercepted and altered, and an attacker can exploit this remotely over the network without authentication or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:29Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.909,"percentile":0.99806,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":50,"pulses":[{"name":"Midwest Malware","url":"https://otx.alienvault.com/pulse/6a8e6c8dc6d3df83aac08378","created":"2026-08-26"},{"name":"Achterdeur ontdekt in veelgebruikte Linux-software [Nationaal Cyber Security Centrum - Nieuwsberichten]","url":"https://otx.alienvault.com/pulse/6a6d28ac2bfe4f71760b2a31","created":"2026-07-31"},{"name":"De XZ-factor: sociale kwetsbaarheden in open source projecten [Nationaal Cyber Security Centrum - Nieuwsberichten]","url":"https://otx.alienvault.com/pulse/6a6d2860a078e91986f7c17b","created":"2026-07-31"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64eccb5d39a90a3c391e","created":"2026-03-22"},{"name":"Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos","url":"https://otx.alienvault.com/pulse/69bf64e1d5e06aa6207f78de","created":"2026-03-22"},{"name":"clone of my pulse. this dmv kit pdfkit.net used the same off logo kit it was one of the few i found in their fcc application   . rpi&macids look for","url":"https://otx.alienvault.com/pulse/69aeda93ec05fb8653adca6d","created":"2026-03-09"},{"name":"com.apple.WebKit.WebContent.CaptivePortal","url":"https://otx.alienvault.com/pulse/69a309b024a430ef4eb25b16","created":"2026-02-28"},{"name":"Trojan Malware","url":"https://otx.alienvault.com/pulse/6998deba4fb8e0ab5abd3b7e","created":"2026-02-20"},{"name":"Corrupt.... Files","url":"https://otx.alienvault.com/pulse/6998d15c75b59044877602c1","created":"2026-02-20"},{"name":"USBank Related Trojan and Persistent Spam Call Data","url":"https://otx.alienvault.com/pulse/69972d6b4111f0205a7983b3","created":"2026-02-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-506","name":"Embedded Malicious Code"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-3094","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2272210","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://www.openwall.com/lists/oss-security/2024/03/29/4","tags":[]},{"url":"https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users","tags":[]},{"url":"https://www.binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-images","tags":[]},{"url":"https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/","tags":["x_transferred"]},{"url":"https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/","tags":["x_transferred"]},{"url":"https://aws.amazon.com/security/security-bulletins/AWS-2024-002/","tags":["x_transferred"]},{"url":"https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz","tags":["x_transferred"]},{"url":"https://boehs.org/node/everything-i-know-about-the-xz-backdoor","tags":["x_transferred"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024","tags":["x_transferred"]},{"url":"https://bugs.gentoo.org/928134","tags":["x_transferred"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1222124","tags":["x_transferred"]},{"url":"https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405","tags":["x_transferred"]},{"url":"https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27","tags":["x_transferred"]},{"url":"https://github.com/advisories/GHSA-rxwq-x6h5-x525","tags":["x_transferred"]},{"url":"https://github.com/amlweems/xzbot","tags":["x_transferred"]},{"url":"https://github.com/karcherm/xz-malware","tags":["x_transferred"]},{"url":"https://gynvael.coldwind.pl/?lang=en&id=782","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-security-announce/2024/msg00057.html","tags":["x_transferred"]},{"url":"https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html","tags":["x_transferred"]},{"url":"https://lwn.net/Articles/967180/","tags":["x_transferred"]},{"url":"https://news.ycombinator.com/item?id=39865810","tags":["x_transferred"]},{"url":"https://news.ycombinator.com/item?id=39877267","tags":["x_transferred"]},{"url":"https://news.ycombinator.com/item?id=39895344","tags":["x_transferred"]},{"url":"https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/","tags":["x_transferred"]},{"url":"https://research.swtch.com/xz-script","tags":["x_transferred"]},{"url":"https://research.swtch.com/xz-timeline","tags":["x_transferred"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-3094","tags":["x_transferred"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-3094","tags":["x_transferred"]},{"url":"https://security.archlinux.org/CVE-2024-3094","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20240402-0001/","tags":["x_transferred"]},{"url":"https://tukaani.org/xz-backdoor/","tags":["x_transferred"]},{"url":"https://twitter.com/LetsDefendIO/status/1774804387417751958","tags":["x_transferred"]},{"url":"https://twitter.com/debian/status/1774219194638409898","tags":["x_transferred"]},{"url":"https://twitter.com/infosecb/status/1774595540233167206","tags":["x_transferred"]},{"url":"https://twitter.com/infosecb/status/1774597228864139400","tags":["x_transferred"]},{"url":"https://ubuntu.com/security/CVE-2024-3094","tags":["x_transferred"]},{"url":"https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094","tags":["x_transferred"]},{"url":"https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils","tags":["x_transferred"]},{"url":"https://www.kali.org/blog/about-the-xz-backdoor/","tags":["x_transferred"]},{"url":"https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils","tags":["x_transferred"]},{"url":"https://www.theregister.com/2024/03/29/malicious_backdoor_xz/","tags":["x_transferred"]},{"url":"https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094","tags":["x_transferred"]},{"url":"https://xeiaso.net/notes/2024/xz-vuln/","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/30/12","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/30/27","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/29/12","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/29/10","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/30/36","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/16/5","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/29/8","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/30/5","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/29/5","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/29/4","tags":["x_transferred"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-31700","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-31700","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":69,"skipped":17,"earliest":"2024-03-29","earliestUrl":"https://github.com/byinarie/CVE-2024-3094-info","repos":[{"name":"amlweems/xzbot","url":"https://github.com/amlweems/xzbot","stars":3554,"created":"2024-04-01"},{"name":"lockness-Ko/xz-vulnerable-honeypot","url":"https://github.com/lockness-Ko/xz-vulnerable-honeypot","stars":147,"created":"2024-03-30"},{"name":"FabioBaroni/CVE-2024-3094-checker","url":"https://github.com/FabioBaroni/CVE-2024-3094-checker","stars":72,"created":"2024-03-29"},{"name":"robertdfrench/ifuncd-up","url":"https://github.com/robertdfrench/ifuncd-up","stars":60,"created":"2024-07-05"},{"name":"byinarie/CVE-2024-3094-info","url":"https://github.com/byinarie/CVE-2024-3094-info","stars":54,"created":"2024-03-29"}]},"first":{"date":"2024-03-29","source":"PoC-in-GitHub","url":"https://github.com/byinarie/CVE-2024-3094-info"},"provenance":"source"},"detections":{"cveRules":[{"title":"Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process","id":"9aa27839-e8ba-4d7a-ac1a-746c22c3d1e5","level":"high","status":"test","path":"rules-emerging-threats/2024/Exploits/CVE-2024-3094/proc_creation_lnx_exploit_cve_2024_3094_sshd_child_process.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-3094/proc_creation_lnx_exploit_cve_2024_3094_sshd_child_process.yml","techniques":[]}]},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-03-29","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-3094","provenance":"source"},{"date":"2024-03-29","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/byinarie/CVE-2024-3094-info","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":35.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9981"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"69 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}