CVE-2024-3094: Tukaani Xz vulnerability (CVSS 10.0)

Description

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Tukaani Xz5.6.0 · 5.6.1

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

References

https://access.redhat.com/security/cve/CVE-2024-3094Vendor Advisory
https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/
https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/Third Party Advisory
https://aws.amazon.com/security/security-bulletins/AWS-2024-002/Third Party Advisory
https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz
https://boehs.org/node/everything-i-know-about-the-xz-backdoorThird Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024Mailing ListVendor Advisory
https://bugs.gentoo.org/928134Issue TrackingThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2272210Issue TrackingVendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1222124Issue TrackingThird Party Advisory

and 45 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2024-3094 being actively exploited?

CVE-2024-3094 is not in the CISA KEV catalog. Its EPSS exploit probability is 86.0%.

How severe is CVE-2024-3094?

CVE-2024-3094 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 86.0% probability of exploitation.

Which products are affected by CVE-2024-3094?

Affected products include Tukaani Xz.

How do I fix CVE-2024-3094?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-3094 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo