Microsoft engineer Andres Freund disclosed that recent versions of xz Utils, a compression library found in most Linux distributions, contained a backdoor that could allow attackers to break SSH authentication and gain remote access. The flaw was tracked as CVE-2024-3094.
What happened
- Freund noticed slow SSH logins and unusual CPU use on a Debian test system and traced them to malicious code in xz versions 5.6.0 and 5.6.1.
- The code had been introduced by a contributor using the name ‘Jia Tan’, who had been contributing to the project since at least late 2021 and had gained maintainer access.
- The affected versions had reached mainly testing, development, and rolling-release distributions such as Fedora 41, Debian unstable, and Kali Linux, so stable releases like Red Hat Enterprise Linux and Debian stable were not affected.
- CISA and Linux distributors urged users to downgrade to an uncompromised version such as 5.4.6.
Why it mattered
It revealed a patient, well-resourced attempt to subvert open source infrastructure through social engineering of an overstretched volunteer maintainer, and it was caught largely by chance.
Lessons for organisations
Keep an inventory of the open source components you rely on (a software bill of materials) and monitor advisories for them. Supplier risk management under ISO/IEC 27001 should consider the health and resourcing of critical open source projects, not only commercial vendors.
Sources: CISA, BleepingComputer
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
