XZ Utils Backdoor in Versions 5.6.0 and 5.6.1 Could Enable SSH-Based RCE
Summary
Researchers describe how a backdoor in XZ Utils 5.6.0 and 5.6.1 can enable remote code execution through SSH under specific conditions, and share findings on its hooks, log concealment, affected distributions and remediation.
Key points
- The backdoor was found in XZ Utils 5.6.0 and 5.6.1 source packages; its build process uses obfuscated code and a concealed test file to modify liblzma.
- Under specific build and runtime conditions, the compromised library can affect OpenSSH authentication and execute a payload; the article says this is remote code execution, not an authentication bypass.
- The described build conditions include x86-64 Linux and Debian or RPM package builds. Runtime checks include the sshd process and avoidance of certain debugging or linker variables.
- Wiz reported potential hooks for RSA_public_decrypt, EVP_PKEY_set1_RSA and RSA_get0_key.
- The backdoor can conceal activity in SSH logs by substituting a fake public key, filtering log entries or replacing successful-connection entries with failed-attempt messages.
- Wiz estimated that about 2% of cloud environments had instances with vulnerable versions.
- CISA advised downgrading to an uncompromised version earlier than 5.6.0 and hunting for suspicious activity on systems where affected versions were installed; distribution-specific status and fixes vary.
Article Details
- Attack Vectors
- A backdoor in XZ Utils versions 5.6.0 and 5.6.1 can, under specified conditions, enable remote code execution during SSH public-key authentication on affected Linux distributions.
- During package builds, obfuscated code uses a concealed test file to extract a precompiled object that alters liblzma symbol resolution. The build-time installation is limited by checks including x86-64 Linux and Debian or RPM packaging.
- At runtime, the backdoor targets sshd and extracts a command payload from public-key authentication data; after verification and signature checks, it passes the payload to libc's system() function.
- The backdoor checks environment variables and detects debugging tools such as rr and gdb; it also uses SSH log filtering, replacement, or a hardcoded fake public key to conceal activity.
- Defensive Notes
- Follow the affected-distribution guidance in the article, including downgrading to an uncompromised XZ Utils version earlier than 5.6.0.
- Hunt for malicious or suspicious activity on systems where affected versions were installed.
- Review SSH logs for suspicious authentication failures, repeated connections without corresponding accept or reject messages, or unexpected failed-connection entries; the article notes that some log anomalies can also occur legitimately.
- Use the Wiz Threat Center query and advisory, if available, to search for vulnerable instances.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe backdoor uses complex obfuscation in build-time scripts and concealed source artifacts to hide its functionality.T1059.004 · Unix ShellAfter validating a payload extracted from SSH public-key authentication data, the backdoor passes it to libc system() for execution.T1546.006 · LC_LOAD_DYLIB AdditionThe backdoor hooks SSH logging functions to filter or replace log entries and conceal activity.T1574.006 · Dynamic Linker HijackingThe build process modifies liblzma symbol resolution so selected functions resolve to backdoor code loaded through the library.T1622 · Debugger EvasionThe runtime exploit checks for debugging tools such as rr and gdb and does not run when they are detected.
CVE
People
Andres FreundDiscovered the backdoor after investigating unusual sshd CPU usage and Valgrind errors.Anthony WeemsDocumented that commands sent to the backdoor are disguised as public-key information during the SSH handshake.JiaT75The article reports that the author of the malicious code used this handle and also submitted code to oss-fuzz that may have prevented the fuzzer from detecting the backdoor.
Vendors
Products
Alpine LinuxAlpine - xz 5.6.0Amazon LinuxAmazon Linux Not affected. - - -Arch LinuxArch Linux advisory Debian LinuxDebian No Debian stable versions are known to be affected, but non-stable branches are affected. xz-utils From 5.5.1alpha-0.1 up to and including 5.6.1-1 5.6.1+really5.4.5-1FedoraRedHat Red Hat Enterprise Linux (RHEL) is not affected, but Fedora 41 and Fedora Rawhide are affected. xz Fedora 41 and Fedora Rawhide RedHat has advised users to immediately stop any instances of Fedora 41 or FedoraFreeBSDFreeBSD Not affected. - - -GentooGentoo Gentoo recommends downgrading to an older version. xz-utils >= 5.6.0 < 5.6.0Kali LinuxKali Linux Affects Kali installations updated between March 26th to March 29th. xz-utils 5.6.0-0.2 Upgrade to the latest versionLinuxA backdoor has been identified in versions 5.6.0 and 5.6.1 of XZ Utils (assigned CVE-2024-3094), which under some conditions may allow RCE via SSH authentication in specific versions of certain Linux distributions.OpenSSHwithin the liblzma code. Consequently, this results in a compromised liblzma library, which affects OpenSSH when it supports systemd notification. This is because libsystemd relies on lzma, and the backdoor canopenSUSEOpenSUSE openSUSE maintainers have rolled back the version of xz on Tumbleweed on March 28th and have released a new Tumbleweed snapshot (20240328 or later) that was built from a safe backup. xz 5.6.0Red Hat Enterprise LinuxRedHat Red Hat Enterprise Linux (RHEL) is not affected, but Fedora 41 and Fedora Rawhide are affected. xz Fedora 41 and Fedora Rawhide RedHat has advised users to immediately stop any instances of Fedora 41 or FedoraXZ UtilsA backdoor has been identified in versions 5.6.0 and 5.6.1 of XZ Utils (assigned CVE-2024-3094), which under some conditions may allow RCE via SSH authentication in specific versions of certain Linux distributions.
Tools
gdbThe exploit detect whether debugging tools such as rr and gdb are being used and if so it doesn't run - a classic anti-debugging technique.rrThe exploit detect whether debugging tools such as rr and gdb are being used and if so it doesn't run - a classic anti-debugging technique.valgrindamount of CPU during the login process. Additionally, he encountered numerous errors while using the 'Valgrind' tool for profiling and memory debugging, prompting him to investigate further.