2024Supply chain
XZ Utils backdoor
Discovered 29 March 2024
A software engineer investigating slow SSH logins found a backdoor in versions 5.6.0 and 5.6.1 of the xz compression library (CVE-2024-3094). The malicious code, hidden in release tarballs and test files, could interfere with SSH authentication on some Linux systems. It had been added after a contributor spent years building trust as a co-maintainer of the project.
- Victim
- Open-source software supply chain (Linux distributions shipping xz 5.6.0 or 5.6.1)
- Sector
- Technology (open source)
- Public attribution
- Inserted by a contributor using the name Jia Tan; the cited sources make no attribution beyond that.
Impact
Discovered within weeks of the affected releases; CISA advised developers and users to downgrade XZ Utils to an uncompromised version.
Root cause
A long social-engineering campaign against an under-resourced open-source project, and build artefacts that differed from the reviewed source code.
Lessons learned: the controls it teaches
- Verify that release artefacts match the reviewed source (reproducible builds).
- Support and review maintainers of critical open-source dependencies.
- Investigate performance anomalies; that is how this backdoor was caught.