CVE-2024-3094

CRITICAL 10.0

Xz: malicious code in distributed source

CVSS Score

10.0

EPSS Score

0.0%

EPSS Percentile

0th

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

CWE	CWE-506
Published	Mar 29, 2024
Last Updated	Nov 20, 2025

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new critical vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Red Hat / Red Hat Enterprise Linux 10

All versions affected

Red Hat / Red Hat Enterprise Linux 6

All versions affected

Red Hat / Red Hat Enterprise Linux 7

All versions affected

Red Hat / Red Hat Enterprise Linux 8

All versions affected

Red Hat / Red Hat Enterprise Linux 9

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 8

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/security/cve/CVE-2024-3094 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2272210 openwall.com: https://www.openwall.com/lists/oss-security/2024/03/29/4 redhat.com: https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users binarly.io: https://www.binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-images ariadne.space: https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/ arstechnica.com: https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/ aws.amazon.com: https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ blog.netbsd.org: https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz boehs.org: https://boehs.org/node/everything-i-know-about-the-xz-backdoor bugs.debian.org: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024 bugs.gentoo.org: https://bugs.gentoo.org/928134 bugzilla.suse.com: https://bugzilla.suse.com/show_bug.cgi?id=1222124 discourse.nixos.org: https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405 gist.github.com: https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 github.com: https://github.com/advisories/GHSA-rxwq-x6h5-x525 github.com: https://github.com/amlweems/xzbot github.com: https://github.com/karcherm/xz-malware gynvael.coldwind.pl: https://gynvael.coldwind.pl/?lang=en&id=782 lists.debian.org: https://lists.debian.org/debian-security-announce/2024/msg00057.html lists.freebsd.org: https://lists.freebsd.org/archives/freebsd-security/2024-March/000248.html lwn.net: https://lwn.net/Articles/967180/ news.ycombinator.com: https://news.ycombinator.com/item?id=39865810 news.ycombinator.com: https://news.ycombinator.com/item?id=39877267 news.ycombinator.com: https://news.ycombinator.com/item?id=39895344 openssf.org: https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/ research.swtch.com: https://research.swtch.com/xz-script research.swtch.com: https://research.swtch.com/xz-timeline security-tracker.debian.org: https://security-tracker.debian.org/tracker/CVE-2024-3094 security.alpinelinux.org: https://security.alpinelinux.org/vuln/CVE-2024-3094 security.archlinux.org: https://security.archlinux.org/CVE-2024-3094 security.netapp.com: https://security.netapp.com/advisory/ntap-20240402-0001/ tukaani.org: https://tukaani.org/xz-backdoor/ twitter.com: https://twitter.com/LetsDefendIO/status/1774804387417751958 twitter.com: https://twitter.com/debian/status/1774219194638409898 twitter.com: https://twitter.com/infosecb/status/1774595540233167206 twitter.com: https://twitter.com/infosecb/status/1774597228864139400 ubuntu.com: https://ubuntu.com/security/CVE-2024-3094 cisa.gov: https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 darkreading.com: https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils kali.org: https://www.kali.org/blog/about-the-xz-backdoor/ tenable.com: https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils theregister.com: https://www.theregister.com/2024/03/29/malicious_backdoor_xz/ vicarius.io: https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-3094 xeiaso.net: https://xeiaso.net/notes/2024/xz-vuln/ openwall.com: http://www.openwall.com/lists/oss-security/2024/03/30/12 openwall.com: http://www.openwall.com/lists/oss-security/2024/03/30/27 openwall.com: http://www.openwall.com/lists/oss-security/2024/03/29/12 openwall.com: http://www.openwall.com/lists/oss-security/2024/03/29/10 openwall.com: http://www.openwall.com/lists/oss-security/2024/03/30/36 openwall.com: http://www.openwall.com/lists/oss-security/2024/04/16/5 openwall.com: http://www.openwall.com/lists/oss-security/2024/03/29/8 openwall.com: http://www.openwall.com/lists/oss-security/2024/03/30/5 openwall.com: http://www.openwall.com/lists/oss-security/2024/03/29/5 openwall.com: http://www.openwall.com/lists/oss-security/2024/03/29/4

Credits

Red Hat would like to thank Andres Freund for reporting this issue.