Description
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | xz | 5.6.0, 5.6.1 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xz-utils | 5.6.1+really5.4.5-1 | — |
| Debian 13 | xz-utils | 5.6.1+really5.4.5-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xz | 5.6.2-1.1 | openSUSE-SU-2024:14017-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | xz | 5.6.1-r2 | — |
| Alpine v3.23 | xz | 5.6.1-r2 | — |
| Alpine v3.22 | xz | 5.6.1-r2 | — |
| Alpine v3.21 | xz | 5.6.1-r2 | — |
| Alpine v3.20 | xz | 5.6.1-r2 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.18 | lighttpd | 1.4.76-r0 | — |
| Alpine v3.17 | lighttpd | 1.4.76-r0 | — |
| Alpine v3.16 | lighttpd | 1.4.76-r0 | — |
| Alpine v3.15 | lighttpd | 1.4.76-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 89 repositories · most starred shown
-
amlweems/xzbot ★ 3,558 · Apr 1, 2024
notes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)
-
lockness-Ko/xz-vulnerable-honeypot ★ 147 · Mar 30, 2024
An ssh honeypot with the XZ backdoor. CVE-2024-3094
-
FabioBaroni/CVE-2024-3094-checker ★ 72 · Mar 29, 2024
Quick and dirty PoC for checking whether a vulnerable version of xz-utils is installed (CVE-2024-3094)
-
robertdfrench/ifuncd-up ★ 63 · Jul 5, 2024
GNU IFUNC is the real culprit behind CVE-2024-3094
-
byinarie/CVE-2024-3094-info ★ 55 · Mar 29, 2024
Information for CVE-2024-3094
-
jfrog/cve-2024-3094-tools ★ 44 · Mar 31, 2024
-
gensecaihq/CVE-2024-3094-Vulnerability-Checker-Fixer ★ 26 · Mar 30, 2024
Shell scripts to identify and fix installations of xz-utils affected by the CVE-2024-3094 vulnerability. Versions 5.6.0 and 5.6.1 of xz-utils are known to be vulnerable, and this script aids in detec…
-
0xlane/xz-cve-2024-3094 ★ 17 · Apr 1, 2024
XZ Backdoor Extract(Test on Ubuntu 23.10)
-
r0binak/xzk8s ★ 14 · Apr 2, 2024
Dockerfile and Kubernetes manifests for reproduce CVE-2024-3094
-
emirkmo/xz-backdoor-github ★ 11 · Mar 30, 2024
History of commits related to the xz backdoor Discovered On March 29, 2024: CVE-2024-3094.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- openSUSE-SU-2024:14017-1 liblzma5-32bit-5.6.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0762 xz: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode BSI CERT-Bund (WID) · Apr 1, 2024